oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

Try handle MS san better.

Browse Source 
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@25130 ec53bebd-3082-4978-b11e-865c3cabbd6b
This commit is contained in:
Love Hörnquist Åstrand
2009-04-25 16:25:50 +00:00
parent 22673e4df8
commit 76499897fd
1 changed files with 35 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

57
lib/krb5/pkinit.c
View File

@@ -2363,14 +2363,12 @@ krb5_get_init_creds_opt_set_pkinit(krb5_context context,
#ifdef PKINIT #ifdef PKINIT
static int static int
match_ms_san(hx509_context context, hx509_cert cert, void *ctx) get_ms_san(hx509_context context, hx509_cert cert, char **upn)
{ {
hx509_octet_string_list list; hx509_octet_string_list list;
char **result = ctx;
int ret; int ret;
if (*result) *upn = NULL;
return 0;
ret = hx509_cert_find_subjectAltName_otherName(context, ret = hx509_cert_find_subjectAltName_otherName(context,
cert, cert,
@@ -2379,20 +2377,30 @@ match_ms_san(hx509_context context, hx509_cert cert, void *ctx)
if (ret) if (ret)
return 0; return 0;
if (list.len > 0 && list.val[0].length > 0) { if (list.len > 0 && list.val[0].length > 0)
ret = decode_MS_UPN_SAN(list.val[0].data, list.val[0].length, ret = decode_MS_UPN_SAN(list.val[0].data, list.val[0].length,
result, NULL); upn, NULL);
if (ret) else
*result = NULL; ret = 1;
}
hx509_free_octet_string_list(&list); hx509_free_octet_string_list(&list);
if (*result == NULL) return ret;
return 0;
return 1;
} }
static int
find_ms_san(hx509_context context, hx509_cert cert, void *ctx)
{
char *upn;
int ret;
ret = get_ms_san(context, cert, &upn);
if (ret == 0)
free(upn);
return ret;
}
#endif #endif
/* /*
@@ -2407,10 +2415,11 @@ _krb5_pk_enterprise_cert(krb5_context context,
{ {
#ifdef PKINIT #ifdef PKINIT
krb5_error_code ret; krb5_error_code ret;
char *enterprise_name = NULL;
hx509_context hx509ctx; hx509_context hx509ctx;
hx509_certs certs, result; hx509_certs certs, result;
hx509_cert cert;
hx509_query *q; hx509_query *q;
char *name;
*principal = NULL; *principal = NULL;
@@ -2437,25 +2446,29 @@ _krb5_pk_enterprise_cert(krb5_context context,
hx509_query_match_option(q, HX509_QUERY_OPTION_PRIVATE_KEY); hx509_query_match_option(q, HX509_QUERY_OPTION_PRIVATE_KEY);
hx509_query_match_option(q, HX509_QUERY_OPTION_KU_DIGITALSIGNATURE); hx509_query_match_option(q, HX509_QUERY_OPTION_KU_DIGITALSIGNATURE);
hx509_query_match_eku(q, oid_id_pkinit_ms_eku()); hx509_query_match_eku(q, oid_id_pkinit_ms_eku());
hx509_query_match_cmp_func(q, match_ms_san, &enterprise_name); hx509_query_match_cmp_func(q, find_ms_san, NULL);
ret = hx509_certs_filter(hx509ctx, certs, q, &result); ret = hx509_certs_filter(hx509ctx, certs, q, &result);
hx509_query_free(hx509ctx, q); hx509_query_free(hx509ctx, q);
hx509_certs_free(&certs); hx509_certs_free(&certs);
if (ret) if (ret)
return ret; return ret;
if (enterprise_name == NULL)
return ENOENT; /* XXX */ ret = hx509_get_one_cert(hx509ctx, result, &cert);
hx509_certs_free(&result);
if (ret)
return ret;
ret = krb5_make_principal(context, principal, realm, ret = get_ms_san(hx509ctx, cert, &name);
enterprise_name, NULL); if (ret)
free(enterprise_name); return ret;
ret = krb5_make_principal(context, principal, realm, name, NULL);
free(name);
hx509_context_free(&hx509ctx); hx509_context_free(&hx509ctx);
if (ret) if (ret)
return ret; return ret;
krb5_principal_set_type(context, *principal, KRB5_NT_ENTERPRISE_PRINCIPAL); krb5_principal_set_type(context, *principal, KRB5_NT_ENTERPRISE_PRINCIPAL);
return ret; return ret;