|
 |
ac6aa4 |
From 9312d1892c611d9f0e814cb915488182da2b76cc Mon Sep 17 00:00:00 2001
|
|
|
ac6aa4 |
From: Christian Heimes <cheimes@redhat.com>
|
|
|
ac6aa4 |
Date: Mon, 4 Oct 2021 15:55:44 +0200
|
|
|
ac6aa4 |
Subject: [PATCH] Use extensions template from NSS
|
|
|
ac6aa4 |
|
|
|
ac6aa4 |
Drop certmonger's custom extension template and use the sequence of X509v3
|
|
|
ac6aa4 |
extensions template from NSS.
|
|
|
ac6aa4 |
|
|
|
ac6aa4 |
The certmonger template had a bug that caused certmonger to create CSRs
|
|
|
ac6aa4 |
with invalid DER. It was encoding extension's critical element even for
|
|
|
ac6aa4 |
default value FALSE.
|
|
|
ac6aa4 |
|
|
|
ac6aa4 |
Fixes: https://pagure.io/certmonger/issue/223
|
|
|
ac6aa4 |
Signed-off-by: Christian Heimes <cheimes@redhat.com>
|
|
|
ac6aa4 |
---
|
|
|
ac6aa4 |
src/certext.c | 41 +----------------------------------------
|
|
|
ac6aa4 |
1 file changed, 1 insertion(+), 40 deletions(-)
|
|
|
ac6aa4 |
|
|
|
ac6aa4 |
diff --git a/src/certext.c b/src/certext.c
|
|
|
ac6aa4 |
index be536987..0d66971e 100644
|
|
|
ac6aa4 |
--- a/src/certext.c
|
|
|
ac6aa4 |
+++ b/src/certext.c
|
|
|
ac6aa4 |
@@ -203,45 +203,6 @@ cm_ms_template_template[] = {
|
|
|
ac6aa4 |
{0, 0, NULL, 0},
|
|
|
ac6aa4 |
};
|
|
|
ac6aa4 |
|
|
|
ac6aa4 |
-/* RFC 5280, 4.1 */
|
|
|
ac6aa4 |
-const SEC_ASN1Template
|
|
|
ac6aa4 |
-cm_certext_cert_extension_template[] = {
|
|
|
ac6aa4 |
- {
|
|
|
ac6aa4 |
- .kind = SEC_ASN1_SEQUENCE,
|
|
|
ac6aa4 |
- .offset = 0,
|
|
|
ac6aa4 |
- .sub = NULL,
|
|
|
ac6aa4 |
- .size = sizeof(CERTCertExtension),
|
|
|
ac6aa4 |
- },
|
|
|
ac6aa4 |
- {
|
|
|
ac6aa4 |
- .kind = SEC_ASN1_OBJECT_ID,
|
|
|
ac6aa4 |
- .offset = offsetof(CERTCertExtension, id),
|
|
|
ac6aa4 |
- .sub = NULL,
|
|
|
ac6aa4 |
- .size = sizeof(SECItem),
|
|
|
ac6aa4 |
- },
|
|
|
ac6aa4 |
- {
|
|
|
ac6aa4 |
- .kind = SEC_ASN1_BOOLEAN,
|
|
|
ac6aa4 |
- .offset = offsetof(CERTCertExtension, critical),
|
|
|
ac6aa4 |
- .sub = NULL,
|
|
|
ac6aa4 |
- .size = sizeof(SECItem),
|
|
|
ac6aa4 |
- },
|
|
|
ac6aa4 |
- {
|
|
|
ac6aa4 |
- .kind = SEC_ASN1_OCTET_STRING,
|
|
|
ac6aa4 |
- .offset = offsetof(CERTCertExtension, value),
|
|
|
ac6aa4 |
- .sub = NULL,
|
|
|
ac6aa4 |
- .size = sizeof(SECItem),
|
|
|
ac6aa4 |
- },
|
|
|
ac6aa4 |
- {0, 0, NULL, 0},
|
|
|
ac6aa4 |
-};
|
|
|
ac6aa4 |
-const SEC_ASN1Template
|
|
|
ac6aa4 |
-cm_certext_sequence_of_cert_extension_template[] = {
|
|
|
ac6aa4 |
- {
|
|
|
ac6aa4 |
- .kind = SEC_ASN1_SEQUENCE_OF,
|
|
|
ac6aa4 |
- .offset = 0,
|
|
|
ac6aa4 |
- .sub = cm_certext_cert_extension_template,
|
|
|
ac6aa4 |
- .size = sizeof(CERTCertExtension **),
|
|
|
ac6aa4 |
- },
|
|
|
ac6aa4 |
-};
|
|
|
ac6aa4 |
-
|
|
|
ac6aa4 |
/* Windows 2000-style UPN */
|
|
|
ac6aa4 |
static unsigned char oid_ms_upn_name_bytes[] = {0x2b, 0x06, 0x01, 0x04, 0x01, 0x82, 0x37, 0x14, 0x02, 0x03};
|
|
|
ac6aa4 |
static const SECOidData oid_ms_upn_name = {
|
|
|
ac6aa4 |
@@ -1960,7 +1921,7 @@ cm_certext_build_csr_extensions(struct cm_store_entry *entry,
|
|
|
ac6aa4 |
/* Encode the sequence. */
|
|
|
ac6aa4 |
memset(&encoded, 0, sizeof(encoded));
|
|
|
ac6aa4 |
if (i > 1) {
|
|
|
ac6aa4 |
- template = cm_certext_sequence_of_cert_extension_template;
|
|
|
ac6aa4 |
+ template = CERT_SequenceOfCertExtensionTemplate;
|
|
|
ac6aa4 |
if (SEC_ASN1EncodeItem(arena, &encoded, &exts_ptr,
|
|
|
ac6aa4 |
template) == &encoded) {
|
|
|
ac6aa4 |
*extensions = talloc_memdup(entry, encoded.data,
|
|
|
ac6aa4 |
--
|
|
|
ac6aa4 |
2.31.1
|
|
|
ac6aa4 |
|