james/yubikey.rs
Public Access
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

tool: fix selfsigned extensions

Browse Source 
previous code was on the naive side
This commit is contained in:
Klas Lindfors
2019-02-15 13:52:56 +01:00
parent 6264c6a578
commit e4e3137556
1 changed files with 31 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tool/yubico-piv-tool.c
+31 -6
View File
@@ -800,10 +800,11 @@ request_out:
static const struct {
int nid;
const char *ext;
int critical;
} selfsign_extensions[] = {
{NID_subject_key_identifier, "hash"},
{NID_authority_key_identifier, "keyid"},
{NID_basic_constraints, "CA:true"},
{NID_subject_key_identifier, "hash", 0},
{NID_authority_key_identifier, "keyid", 0},
{NID_basic_constraints, "CA:true", 1},
};
static bool selfsign_certificate(ykpiv_state *state, enum enum_key_format key_format,
@@ -933,14 +934,38 @@ static bool selfsign_certificate(ykpiv_state *state, enum enum_key_format key_fo
{
X509V3_CTX ctx;
X509_EXTENSION *ext;
int i;
X509V3_set_ctx(&ctx, x509, x509, NULL, NULL, 0);
for(i = 0; i < sizeof(selfsign_extensions) / sizeof(selfsign_extensions[0]); i++) {
X509_EXTENSION *ext = NULL;
void *ext_struc;
const X509V3_EXT_METHOD *method = X509V3_EXT_get_nid(selfsign_extensions[i].nid);
void *ext_struc = method->s2i(method, &ctx, selfsign_extensions[i].ext);
ext = X509V3_EXT_i2d(NID_subject_key_identifier, 0, ext_struc);
if(!method) {
fprintf(stderr, "Failed to get extension method for nid %d.\n", selfsign_extensions[i].nid);
goto selfsign_out;
}
if(method->v2i) {
STACK_OF(CONF_VALUE) *nval = X509V3_parse_list(selfsign_extensions[i].ext);
if(!nval) {
fprintf(stderr, "Failed parsing extension value for nid %d.\n", selfsign_extensions[i].nid);
goto selfsign_out;
}
ext_struc = method->v2i(method, &ctx, nval);
} else if(method->s2i) {
ext_struc = method->s2i(method, &ctx, selfsign_extensions[i].ext);
} else {
fprintf(stderr, "Unknown way to construct extension for nid %d.\n", selfsign_extensions[i].nid);
goto selfsign_out;
}
if(!ext_struc) {
fprintf(stderr, "Failed constructing extension value for nid %d.\n", selfsign_extensions[i].nid);
goto selfsign_out;
}
ext = X509V3_EXT_i2d(selfsign_extensions[i].nid, selfsign_extensions[i].critical, ext_struc);
if(!X509_add_ext(x509, ext, -1)) {
fprintf(stderr, "Failed adding extension %d (%d).\n", i, selfsign_extensions[i].nid);
goto selfsign_out;