From: Nikos Mavrogiannopoulos <nmav@crystal.(none)>
Date: Wed, 5 Nov 2008 20:04:38 +0000 (+0200)
Subject: certtool: allow setting arbitrary key purpose object identifiers.
X-Git-Tag: gnutls_2_7_2~99
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=6a1e93052ecd697fa9ac92ad165fac0b4cc91dc0;p=thirdparty%2Fgnutls.git

certtool: allow setting arbitrary key purpose object identifiers.
---

diff --git a/NEWS b/NEWS
index 527f33893e..45dc287c75 100644
--- a/NEWS
+++ b/NEWS
@@ -5,6 +5,8 @@ See the end for copying conditions.
 
 * Version 2.7.2 (unreleased)
 
+** certtool: allow setting arbitrary key purpose object identifiers.
+
 ** libgnutls: Fix detection of C99 macros, to make debug logging work again.
 
 ** libgnutls: Add missing prototype for gnutls_srp_set_prime_bits.
diff --git a/doc/certtool.cfg b/doc/certtool.cfg
index 7d44d98fc2..635c347d08 100644
--- a/doc/certtool.cfg
+++ b/doc/certtool.cfg
@@ -110,3 +110,6 @@ signing_key
 
 # A name for a PKCS #12 key
 #pkcs12_key_name = "Anonymous key"
+
+#a space separated list of key purpose OIDs to be added
+#key_purpose_oids = "1.3.6.1.5.5.7.3.1"
diff --git a/src/certtool-cfg.c b/src/certtool-cfg.c
index 7ac21650e3..fc77307c53 100644
--- a/src/certtool-cfg.c
+++ b/src/certtool-cfg.c
@@ -72,6 +72,7 @@ typedef struct _cfg_ctx
   int code_sign_key;
   int ocsp_sign_key;
   int time_stamping_key;
+  char** key_purpose_oids;
   int crl_next_update;
   int crl_number;
   int crq_extensions;
@@ -121,6 +122,8 @@ template_parse (const char *template)
 
     {NULL, '\0', "dn_oid", CFG_STR + CFG_MULTI_SEPARATED,
      (void *) &cfg.dn_oid, 0},
+    {NULL, '\0', "key_purpose_oids", CFG_STR + CFG_MULTI_SEPARATED,
+     (void *) &cfg.key_purpose_oids, 0},
 
     {NULL, '\0', "crl_dist_points", CFG_STR,
      (void *) &cfg.crl_dist_points, 0},
@@ -584,6 +587,28 @@ get_oid_crt_set (gnutls_x509_crt_t crt)
 	    }
 	}
     }
+}
+
+void
+get_key_purpose_set (gnutls_x509_crt_t crt)
+{
+  int ret, i;
+
+  if (batch)
+    {
+      if (!cfg.key_purpose_oids)
+	return;
+      for (i = 0; cfg.key_purpose_oids[i] != NULL; i ++)
+	{
+	  ret = gnutls_x509_crt_set_key_purpose_oid (crt, cfg.key_purpose_oids[i], 0);
+
+	  if (ret < 0)
+	    {
+	      fprintf (stderr, "set_key_purpose_oid (%s): %s\n",  cfg.key_purpose_oids[i], gnutls_strerror (ret));
+	      exit (1);
+	    }
+	}
+    }
 
 }
 
diff --git a/src/certtool.c b/src/certtool.c
index 33e8db0abc..0388b2bbd6 100644
--- a/src/certtool.c
+++ b/src/certtool.c
@@ -304,6 +304,7 @@ generate_certificate (gnutls_x509_privkey_t * ret_key,
 	  get_cn_crt_set (crt);
 	  get_uid_crt_set (crt);
 	  get_oid_crt_set (crt);
+	  get_key_purpose_set( crt);
 
 	  if (!batch)
 	    fprintf (stderr,