|
 |
0a8476 |
diff --git a/lib/libswan/Makefile b/lib/libswan/Makefile
|
|
|
0a8476 |
index 510148ad1..0f5c26228 100644
|
|
|
0a8476 |
--- a/lib/libswan/Makefile
|
|
|
0a8476 |
+++ b/lib/libswan/Makefile
|
|
|
0a8476 |
@@ -200,10 +200,6 @@ CFLAGS+=-I${LIBRESWANSRCDIR}/include ${PORTINCLUDE}
|
|
|
0a8476 |
CFLAGS+=$(USERLAND_CFLAGS)
|
|
|
0a8476 |
CFLAGS+=${CROSSFLAGS}
|
|
|
0a8476 |
|
|
|
0a8476 |
-ifeq ($(NSS_REQ_AVA_COPY),true)
|
|
|
0a8476 |
-CFLAGS+=-DNSS_REQ_AVA_COPY
|
|
|
0a8476 |
-endif
|
|
|
0a8476 |
-
|
|
|
0a8476 |
OBJS += $(abs_builddir)/version.o
|
|
|
0a8476 |
|
|
|
0a8476 |
include $(top_srcdir)/mk/library.mk
|
|
|
0a8476 |
diff --git a/mk/config.mk b/mk/config.mk
|
|
|
0a8476 |
index 3f2bd55c1..fcdabd1fb 100644
|
|
|
0a8476 |
--- a/mk/config.mk
|
|
|
0a8476 |
+++ b/mk/config.mk
|
|
|
0a8476 |
@@ -242,6 +242,17 @@ NSPR_LDFLAGS ?= -lnspr4
|
|
|
0a8476 |
# Use nss copy for CERT_CompareAVA
|
|
|
0a8476 |
# See https://bugzilla.mozilla.org/show_bug.cgi?id=1336487
|
|
|
0a8476 |
NSS_REQ_AVA_COPY?=true
|
|
|
0a8476 |
+ifeq ($(NSS_REQ_AVA_COPY),true)
|
|
|
0a8476 |
+NSSFLAGS+=-DNSS_REQ_AVA_COPY
|
|
|
0a8476 |
+endif
|
|
|
0a8476 |
+
|
|
|
0a8476 |
+# Use nss IPsec profile for X509 validation. This is less restrictive
|
|
|
0a8476 |
+# ok EKU's. This is not yet in upstream nss.
|
|
|
0a8476 |
+# See https://bugzilla.mozilla.org/show_bug.cgi?id=1252891
|
|
|
0a8476 |
+NSS_HAS_IPSEC_PROFILE?=false
|
|
|
0a8476 |
+ifeq ($(NSS_HAS_IPSEC_PROFILE),true)
|
|
|
0a8476 |
+NSSFLAGS+=-DNSS_IPSEC_PROFILE
|
|
|
0a8476 |
+endif
|
|
|
0a8476 |
|
|
|
0a8476 |
# Use a local copy of xfrm.h. This can be needed on older systems
|
|
|
0a8476 |
# that do not ship linux/xfrm.h, or when the shipped version is too
|
|
|
0a8476 |
diff --git a/programs/pluto/nss_cert_verify.c b/programs/pluto/nss_cert_verify.c
|
|
|
0a8476 |
index 95c637f53..7d458ac2a 100644
|
|
|
0a8476 |
--- a/programs/pluto/nss_cert_verify.c
|
|
|
0a8476 |
+++ b/programs/pluto/nss_cert_verify.c
|
|
|
0a8476 |
@@ -299,6 +299,28 @@ static int vfy_chain_pkix(CERTCertificate **chain, int chain_len,
|
|
|
0a8476 |
cvout[1].value.pointer.chain = NULL;
|
|
|
0a8476 |
cvout[2].type = cert_po_end;
|
|
|
0a8476 |
|
|
|
0a8476 |
+ int fin;
|
|
|
0a8476 |
+
|
|
|
0a8476 |
+#ifdef NSS_IPSEC_PROFILE
|
|
|
0a8476 |
+ SECStatus rv = CERT_PKIXVerifyCert(end_cert, certificateUsageIPsec,
|
|
|
0a8476 |
+ cvin, cvout, NULL);
|
|
|
0a8476 |
+ if (rv != SECSuccess || cur_log->count > 0) {
|
|
|
0a8476 |
+ if (cur_log->count > 0 && cur_log->head != NULL) {
|
|
|
0a8476 |
+ fin = nss_err_to_revfail(cur_log->head);
|
|
|
0a8476 |
+ } else {
|
|
|
0a8476 |
+ /*
|
|
|
0a8476 |
+ * An rv != SECSuccess without CERTVerifyLog
|
|
|
0a8476 |
+ * results should not * happen, but catch it anyway
|
|
|
0a8476 |
+ */
|
|
|
0a8476 |
+ loglog(RC_LOG_SERIOUS, "X509: unspecified NSS verification failure");
|
|
|
0a8476 |
+ fin = VERIFY_RET_FAIL;
|
|
|
0a8476 |
+ }
|
|
|
0a8476 |
+ } else {
|
|
|
0a8476 |
+ DBG(DBG_X509, DBG_log("certificate is valid"));
|
|
|
0a8476 |
+ *end_out = end_cert;
|
|
|
0a8476 |
+ fin = VERIFY_RET_OK;
|
|
|
0a8476 |
+ }
|
|
|
0a8476 |
+#else
|
|
|
0a8476 |
/* kludge alert!!
|
|
|
0a8476 |
* verification may be performed twice: once with the
|
|
|
0a8476 |
* 'client' usage and once with 'server', which is an NSS
|
|
|
0a8476 |
@@ -307,12 +329,10 @@ static int vfy_chain_pkix(CERTCertificate **chain, int chain_len,
|
|
|
0a8476 |
* KU/EKU combinations
|
|
|
0a8476 |
*/
|
|
|
0a8476 |
|
|
|
0a8476 |
- int fin;
|
|
|
0a8476 |
SECCertificateUsage usage;
|
|
|
0a8476 |
|
|
|
0a8476 |
for (usage = certificateUsageSSLClient; ; usage = certificateUsageSSLServer) {
|
|
|
0a8476 |
SECStatus rv = CERT_PKIXVerifyCert(end_cert, usage, cvin, cvout, NULL);
|
|
|
0a8476 |
-
|
|
|
0a8476 |
if (rv != SECSuccess || cur_log->count > 0) {
|
|
|
0a8476 |
if (cur_log->count > 0 && cur_log->head != NULL) {
|
|
|
0a8476 |
if (usage == certificateUsageSSLClient &&
|
|
|
0a8476 |
@@ -346,6 +366,7 @@ static int vfy_chain_pkix(CERTCertificate **chain, int chain_len,
|
|
|
0a8476 |
}
|
|
|
0a8476 |
break;
|
|
|
0a8476 |
}
|
|
|
0a8476 |
+#endif
|
|
|
0a8476 |
pexpect(fin != 0);
|
|
|
0a8476 |
|
|
|
0a8476 |
CERT_DestroyCertList(trustcl);
|
|
|
0a8476 |
diff --git a/programs/pluto/plutomain.c b/programs/pluto/plutomain.c
|
|
|
0a8476 |
index 50582822d..007d73f45 100644
|
|
|
0a8476 |
--- a/programs/pluto/plutomain.c
|
|
|
0a8476 |
+++ b/programs/pluto/plutomain.c
|
|
|
0a8476 |
@@ -180,6 +180,12 @@ static const char compile_time_interop_options[] = ""
|
|
|
0a8476 |
" BROKEN_POPEN"
|
|
|
0a8476 |
#endif
|
|
|
0a8476 |
" NSS"
|
|
|
0a8476 |
+#ifdef NSS_REQ_AVA_COPY
|
|
|
0a8476 |
+ " (AVA copy)"
|
|
|
0a8476 |
+#endif
|
|
|
0a8476 |
+#ifdef NSS_IPSEC_PROFILE
|
|
|
0a8476 |
+ " (IPsec profile)"
|
|
|
0a8476 |
+#endif
|
|
|
0a8476 |
#ifdef USE_DNSSEC
|
|
|
0a8476 |
" DNSSEC"
|
|
|
0a8476 |
#endif
|