Skip to content

Commit 081bc57

Browse files
arekinatharekinath
committed
pivy-ca: add support for cert policies
1 parent af8b935 commit 081bc57

File tree

1 file changed

+91
-10
lines changed

1 file changed

+91
-10
lines changed

‎piv-certs.c

+91-10
Original file line numberDiff line numberDiff line change
@@ -109,6 +109,8 @@ errf_t *validate_cstring(const char *buf, size_t len, size_t maxlen);
109109
#define PARAM_AD_SID { "ad_sid", 0, "MS AD SID (see KB5014754). Accepts " \
110110
"string format (S-1-5-...) or base64-encoded " \
111111
"(AQUAAAA...) SIDs." }
112+
#define PARAM_POLICIES { "cert_policies", 0, \
113+
"Certificate policies to apply (as an OpenSSL config expression)" }
112114

113115
static errf_t *populate_user_auth(struct cert_var_scope *, X509 *);
114116
static errf_t *populate_user_key_mgmt(struct cert_var_scope *, X509 *);
@@ -133,6 +135,7 @@ struct cert_tpl cert_templates[] = {
133135
.ct_params = {
134136
PARAM_DN,
135137
PARAM_LIFETIME,
138+
PARAM_POLICIES,
136139
PARAM_AD_UPN,
137140
PARAM_KRB5_PN,
138141
PARAM_AD_SID,
@@ -152,6 +155,7 @@ struct cert_tpl cert_templates[] = {
152155
.ct_params = {
153156
PARAM_DN,
154157
PARAM_LIFETIME,
158+
PARAM_POLICIES,
155159
PARAM_AD_UPN,
156160
PARAM_AD_SID,
157161
{ NULL }
@@ -166,6 +170,7 @@ struct cert_tpl cert_templates[] = {
166170
.ct_params = {
167171
PARAM_DN,
168172
PARAM_LIFETIME,
173+
PARAM_POLICIES,
169174
{ "email", RQF_CERT | RQF_CERT_REQ, "E-mail address" },
170175
{ NULL }
171176
},
@@ -179,6 +184,7 @@ struct cert_tpl cert_templates[] = {
179184
.ct_params = {
180185
PARAM_DN,
181186
PARAM_LIFETIME,
187+
PARAM_POLICIES,
182188
{ "dns_name", RQF_CERT | RQF_CERT_REQ, "DNS domain name" },
183189
PARAM_AD_UPN,
184190
PARAM_KRB5_PN,
@@ -197,6 +203,7 @@ struct cert_tpl cert_templates[] = {
197203
.ct_params = {
198204
PARAM_DN,
199205
PARAM_LIFETIME,
206+
PARAM_POLICIES,
200207
PARAM_AD_UPN,
201208
PARAM_KRB5_PN,
202209
{ "email", 0, "E-mail address" },
@@ -211,6 +218,7 @@ struct cert_tpl cert_templates[] = {
211218
.ct_params = {
212219
PARAM_DN,
213220
PARAM_LIFETIME,
221+
PARAM_POLICIES,
214222
{ "ext_key_usage", 0, "Extended key usage constraint" },
215223
{ "path_len", 0, "Maximum CA path length" },
216224
{ "name_constraints", 0,
@@ -1219,11 +1227,12 @@ populate_common(struct cert_var_scope *cs, X509 *cert, char *basic, char *ku,
12191227
char *eku)
12201228
{
12211229
errf_t *err;
1222-
char *lifetime, *dnstr;
1230+
char *lifetime, *dnstr, *policies = NULL;
12231231
unsigned long lifetime_secs;
12241232
X509_EXTENSION *ext;
12251233
X509V3_CTX x509ctx;
12261234
X509_NAME *subj;
1235+
CONF *config = NULL;
12271236

12281237
err = scope_eval(cs, "lifetime", &lifetime);
12291238
if (err != ERRF_OK) {
@@ -1259,31 +1268,67 @@ populate_common(struct cert_var_scope *cs, X509 *cert, char *basic, char *ku,
12591268
VERIFY(X509_set_subject_name(cert, subj) == 1);
12601269
X509_NAME_free(subj);
12611270

1262-
X509V3_set_ctx_nodb(&x509ctx);
1271+
err = scope_eval(cs, "cert_policies", &policies);
1272+
if (err == ERRF_OK) {
1273+
OPENSSL_load_builtin_modules();
1274+
1275+
err = load_ossl_config("piv_ca", cs, &config);
1276+
if (err != ERRF_OK)
1277+
return (err);
1278+
1279+
X509V3_set_nconf(&x509ctx, config);
1280+
} else {
1281+
X509V3_set_ctx_nodb(&x509ctx);
1282+
}
12631283
X509V3_set_ctx(&x509ctx, cert, cert, NULL, NULL, 0);
12641284

12651285
if (basic != NULL) {
12661286
ext = X509V3_EXT_conf_nid(NULL, &x509ctx, NID_basic_constraints,
12671287
(char *)basic);
1268-
VERIFY(ext != NULL);
1288+
if (ext == NULL) {
1289+
make_sslerrf(err, "X509V3_EXT_conf_nid",
1290+
"parsing basicConstraints extension");
1291+
return (err);
1292+
}
12691293
X509_add_ext(cert, ext, -1);
12701294
X509_EXTENSION_free(ext);
12711295
}
12721296

12731297
if (ku != NULL) {
12741298
ext = X509V3_EXT_conf_nid(NULL, &x509ctx, NID_key_usage,
12751299
(char *)ku);
1276-
VERIFY(ext != NULL);
1300+
if (ext == NULL) {
1301+
make_sslerrf(err, "X509V3_EXT_conf_nid",
1302+
"parsing keyUsage extension");
1303+
return (err);
1304+
}
12771305
X509_add_ext(cert, ext, -1);
12781306
X509_EXTENSION_free(ext);
12791307
}
12801308

12811309
if (eku != NULL) {
12821310
ext = X509V3_EXT_conf_nid(NULL, &x509ctx, NID_ext_key_usage,
12831311
(char *)eku);
1284-
VERIFY(ext != NULL);
1312+
if (ext == NULL) {
1313+
make_sslerrf(err, "X509V3_EXT_conf_nid",
1314+
"parsing extKeyUsage extension");
1315+
return (err);
1316+
}
1317+
X509_add_ext(cert, ext, -1);
1318+
X509_EXTENSION_free(ext);
1319+
}
1320+
1321+
if (policies != NULL) {
1322+
ext = X509V3_EXT_conf_nid(NULL, &x509ctx,
1323+
NID_certificate_policies, (char *)policies);
1324+
if (ext == NULL) {
1325+
make_sslerrf(err, "X509V3_EXT_conf_nid",
1326+
"parsing certificatePolicies extension");
1327+
return (err);
1328+
}
12851329
X509_add_ext(cert, ext, -1);
12861330
X509_EXTENSION_free(ext);
1331+
free(policies);
12871332
}
12881333

12891334
return (ERRF_OK);
@@ -2138,10 +2183,11 @@ rpopulate_common(struct cert_var_scope *cs, X509_REQ *req,
21382183
STACK_OF(X509_EXTENSION) *exts, char *basic, char *ku, char *eku)
21392184
{
21402185
errf_t *err;
2141-
char *dnstr;
2186+
char *dnstr, *policies = NULL;
21422187
X509_EXTENSION *ext;
21432188
X509V3_CTX x509ctx;
21442189
X509_NAME *subj;
2190+
CONF *config = NULL;
21452191

21462192
subj = X509_NAME_new();
21472193
VERIFY(subj != NULL);
@@ -2164,28 +2210,63 @@ rpopulate_common(struct cert_var_scope *cs, X509_REQ *req,
21642210
VERIFY(X509_REQ_set_subject_name(req, subj) == 1);
21652211
X509_NAME_free(subj);
21662212

2167-
X509V3_set_ctx_nodb(&x509ctx);
2213+
err = scope_eval(cs, "cert_policies", &policies);
2214+
if (err == ERRF_OK) {
2215+
OPENSSL_load_builtin_modules();
2216+
2217+
err = load_ossl_config("piv_ca", cs, &config);
2218+
if (err != ERRF_OK)
2219+
return (err);
2220+
2221+
X509V3_set_nconf(&x509ctx, config);
2222+
} else {
2223+
X509V3_set_ctx_nodb(&x509ctx);
2224+
}
21682225
X509V3_set_ctx(&x509ctx, NULL, NULL, req, NULL, 0);
21692226

21702227
if (basic != NULL) {
21712228
ext = X509V3_EXT_conf_nid(NULL, &x509ctx, NID_basic_constraints,
21722229
(char *)basic);
2173-
VERIFY(ext != NULL);
2230+
if (ext == NULL) {
2231+
make_sslerrf(err, "X509V3_EXT_conf_nid",
2232+
"parsing basicConstraints extension");
2233+
return (err);
2234+
}
21742235
VERIFY(sk_X509_EXTENSION_push(exts, ext) != 0);
21752236
}
21762237

21772238
if (ku != NULL) {
21782239
ext = X509V3_EXT_conf_nid(NULL, &x509ctx, NID_key_usage,
21792240
(char *)ku);
2180-
VERIFY(ext != NULL);
2241+
if (ext == NULL) {
2242+
make_sslerrf(err, "X509V3_EXT_conf_nid",
2243+
"parsing keyUsage extension");
2244+
return (err);
2245+
}
21812246
VERIFY(sk_X509_EXTENSION_push(exts, ext) != 0);
21822247
}
21832248

21842249
if (eku != NULL) {
21852250
ext = X509V3_EXT_conf_nid(NULL, &x509ctx, NID_ext_key_usage,
21862251
(char *)eku);
2187-
VERIFY(ext != NULL);
2252+
if (ext == NULL) {
2253+
make_sslerrf(err, "X509V3_EXT_conf_nid",
2254+
"parsing extKeyUsage extension");
2255+
return (err);
2256+
}
2257+
VERIFY(sk_X509_EXTENSION_push(exts, ext) != 0);
2258+
}
2259+
2260+
if (policies != NULL) {
2261+
ext = X509V3_EXT_conf_nid(NULL, &x509ctx,
2262+
NID_certificate_policies, (char *)policies);
2263+
if (ext == NULL) {
2264+
make_sslerrf(err, "X509V3_EXT_conf_nid",
2265+
"parsing certificatePolicies extension");
2266+
return (err);
2267+
}
21882268
VERIFY(sk_X509_EXTENSION_push(exts, ext) != 0);
2269+
free(policies);
21892270
}
21902271

21912272
return (ERRF_OK);

0 commit comments

Comments
 (0)