denozord/strongswan-ext
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

x509: Only allow certificates with cRLSign keyUsage to sign CRLs

Browse Source
This commit is contained in:
Tobias Brunner committed 2023-03-21 16:34:14 +01:00
1 parent d12a4f5d23
commit 7d1f221211
1 file changed
+2 -2
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/plugins/x509/x509_crl.c
+2 -2
View File
@@ -462,12 +462,12 @@ METHOD(certificate_t, issued_by, bool,
x509_t *x509 = (x509_t*)issuer; x509_t *x509 = (x509_t*)issuer;
chunk_t keyid = chunk_empty; chunk_t keyid = chunk_empty;
/* check if issuer is an X.509 CA certificate */ /* check if issuer is an X.509 certificate with cRLSign keyUsage bit set */
if (issuer->get_type(issuer) != CERT_X509) if (issuer->get_type(issuer) != CERT_X509)
{ {
return FALSE; return FALSE;
} }
if (!(x509->get_flags(x509) & (X509_CA | X509_CRL_SIGN))) if (!(x509->get_flags(x509) & X509_CRL_SIGN))
{ {
return FALSE; return FALSE;
} }