Blame SOURCES/0015-MS-cert-template-add-template-extension-to-CSR.patch

10e13a
From 616bc539e7054f7e561ca66672019f7990759811 Mon Sep 17 00:00:00 2001
10e13a
From: Fraser Tweedale <ftweedal@redhat.com>
10e13a
Date: Thu, 17 Aug 2017 18:10:37 +1000
10e13a
Subject: [PATCH] MS cert template: add template extension to CSR
10e13a
10e13a
Add the MS V2 certificate template extension to the CSR, when the
10e13a
attribute is set.  Failure to parse the value (as stored) merely
10e13a
causes the extension to be skipped.
10e13a
10e13a
Part of: https://pagure.io/certmonger/issue/78
10e13a
---
10e13a
 src/certext.c | 86 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++--
10e13a
 1 file changed, 84 insertions(+), 2 deletions(-)
10e13a
10e13a
diff --git a/src/certext.c b/src/certext.c
10e13a
index 64ae05a..5f8a743 100644
10e13a
--- a/src/certext.c
10e13a
+++ b/src/certext.c
10e13a
@@ -69,7 +69,7 @@ struct kerberos_principal_name {
10e13a
 struct ms_template {
10e13a
 	SECItem id;
10e13a
 	SECItem major;
10e13a
-	SECItem *minor;
10e13a
+	SECItem minor;
10e13a
 };
10e13a
 
10e13a
 /* KerberosString: RFC 4120, 5.2.1 */
10e13a
@@ -180,7 +180,7 @@ cm_ms_template_template[] = {
10e13a
 	.kind = SEC_ASN1_SEQUENCE,
10e13a
 	.offset = 0,
10e13a
 	.sub = NULL,
10e13a
-	.size = sizeof(struct kerberos_principal_name),
10e13a
+	.size = sizeof(struct ms_template),
10e13a
 	},
10e13a
 	{
10e13a
 	.kind = SEC_ASN1_OBJECT_ID,
10e13a
@@ -1593,6 +1593,76 @@ cm_certext_build_profile(struct cm_store_entry *entry,
10e13a
 	return item;
10e13a
 }
10e13a
 
10e13a
+/* Build a Microsoft certificate template extension value. */
10e13a
+static SECItem *
10e13a
+cm_certext_build_certificate_template(
10e13a
+	PLArenaPool *arena,
10e13a
+	char *template_spec)
10e13a
+{
10e13a
+	struct ms_template template_data;
10e13a
+	memset(&template_data, 0, sizeof(struct ms_template));
10e13a
+
10e13a
+	if (NULL == template_spec || *template_spec == '\0')
10e13a
+		return NULL;
10e13a
+
10e13a
+	/* strtok overwrites delimiters with null bytes;
10e13a
+	 * therefore duplicate the input string */
10e13a
+	char *template_spec_dup = PORT_ArenaStrdup(arena, template_spec);
10e13a
+	if (NULL == template_spec_dup)
10e13a
+		return NULL;
10e13a
+
10e13a
+	int i = 0;
10e13a
+	char *saveptr, *endptr;
10e13a
+	for (
10e13a
+		char *part = strtok_r(template_spec_dup, ":", &saveptr);
10e13a
+		part != NULL;
10e13a
+		part = strtok_r(NULL, ":", &saveptr)
10e13a
+	) {
10e13a
+		if (i == 0) {
10e13a
+			// parse OID
10e13a
+			if (SECSuccess != SEC_StringToOID(arena, &template_data.id, part, 0))
10e13a
+				return NULL;
10e13a
+		}
10e13a
+		else if (i == 1) {
10e13a
+			// parse major version
10e13a
+			long x = strtol(part, &endptr, 10);
10e13a
+			if (*part == '\0' || *endptr != '\0') {
10e13a
+				// string was empty or contained non-digits
10e13a
+				return NULL;
10e13a
+			}
10e13a
+			if (SEC_ASN1EncodeInteger(arena, &template_data.major, x)
10e13a
+					!= &template_data.major)
10e13a
+				return NULL;
10e13a
+		}
10e13a
+		else if (i == 2) {
10e13a
+			// parse minor version
10e13a
+			long x = strtol(part, &endptr, 10);
10e13a
+			if (*part == '\0' || *endptr != '\0') {
10e13a
+				// string was empty or contained non-digits
10e13a
+				return NULL;
10e13a
+			}
10e13a
+			if (SEC_ASN1EncodeInteger(arena, &template_data.minor, x)
10e13a
+					!= &template_data.minor)
10e13a
+				return NULL;
10e13a
+		}
10e13a
+		else {
10e13a
+			// there are too many parts!
10e13a
+			return NULL;
10e13a
+		}
10e13a
+		i++;
10e13a
+	}
10e13a
+	if (i < 2) {
10e13a
+		// there are too few parts! (OID and major version are required)
10e13a
+		return NULL;
10e13a
+	}
10e13a
+
10e13a
+	SECItem encoded;
10e13a
+	if (SEC_ASN1EncodeItem(arena, &encoded, &template_data,
10e13a
+			       cm_ms_template_template) != &encoded)
10e13a
+		return NULL;
10e13a
+	return SECITEM_ArenaDupItem(arena, &encoded);
10e13a
+}
10e13a
+
10e13a
 /* Build a Netscape certtype extension value. */
10e13a
 static SECItem *
10e13a
 cm_certext_build_ns_certtype(struct cm_store_entry *entry,
10e13a
@@ -1840,6 +1910,18 @@ cm_certext_build_csr_extensions(struct cm_store_entry *entry,
10e13a
 			i++;
10e13a
 		}
10e13a
 	}
10e13a
+	if (entry->cm_template_certificate_template != NULL) {
10e13a
+		oid = (SECOidData *) &oid_microsoft_certificate_template;
10e13a
+		item = cm_certext_build_certificate_template(
10e13a
+			arena, entry->cm_template_certificate_template);
10e13a
+		if ((item != NULL) && (oid != NULL)) {
10e13a
+			ext[i].id = oid->oid;
10e13a
+			ext[i].critical = der_false;
10e13a
+			ext[i].value = *item;
10e13a
+			exts[i] = &ext[i];
10e13a
+			i++;
10e13a
+		}
10e13a
+	}
10e13a
 	if (entry->cm_template_ns_certtype != NULL) {
10e13a
 		oid = SECOID_FindOIDByTag(SEC_OID_NS_CERT_EXT_CERT_TYPE);
10e13a
 		item = cm_certext_build_ns_certtype(entry, arena,
10e13a
-- 
10e13a
2.14.4
10e13a