diff options
author | Nikos Mavrogiannopoulos <nmav@gnutls.org> | 2012-05-23 20:58:11 +0200 |
---|---|---|
committer | Nikos Mavrogiannopoulos <nmav@gnutls.org> | 2012-05-23 21:05:01 +0200 |
commit | 5196786c494cd8378adb26d7d6692260d1f7a0ab (patch) | |
tree | 02e7e28a526659876e4815a0c9aa8ee54ba70b5e | |
parent | 01524ab20afe877304a23bd812ab66fb8acf06b7 (diff) | |
download | gnutls-5196786c494cd8378adb26d7d6692260d1f7a0ab.tar.gz |
When checking for an issuer check for a match in the key identifiers.
-rw-r--r-- | lib/x509/verify.c | 40 |
1 files changed, 36 insertions, 4 deletions
diff --git a/lib/x509/verify.c b/lib/x509/verify.c index 23bdcf72c5..0133e88254 100644 --- a/lib/x509/verify.c +++ b/lib/x509/verify.c @@ -218,9 +218,12 @@ cleanup: static int is_issuer (gnutls_x509_crt_t cert, gnutls_x509_crt_t issuer_cert) { - gnutls_datum_t dn1 = { NULL, 0 }, dn2 = - { - NULL, 0}; + gnutls_datum_t dn1 = { NULL, 0 }, + dn2 = { NULL, 0}; + uint8_t id1[512]; + uint8_t id2[512]; + size_t id1_size; + size_t id2_size; int ret; ret = gnutls_x509_crt_get_raw_issuer_dn (cert, &dn1); @@ -238,6 +241,34 @@ is_issuer (gnutls_x509_crt_t cert, gnutls_x509_crt_t issuer_cert) } ret = _gnutls_x509_compare_raw_dn (&dn1, &dn2); + + if (ret != 0) + { + /* check if the authority key identifier matches the subject key identifier + * of the isser */ + id1_size = sizeof(id1); + + ret = gnutls_x509_crt_get_authority_key_id(cert, id1, &id1_size, NULL); + if (ret < 0) + { + ret = 1; + goto cleanup; + } + + id2_size = sizeof(id2); + ret = gnutls_x509_crt_get_subject_key_id(issuer_cert, id2, &id2_size, NULL); + if (ret < 0) + { + ret = 1; + gnutls_assert(); + goto cleanup; + } + + if (id1_size == id2_size && memcmp(id1, id2, id1_size) == 0) + ret = 1; + else + ret = 0; + } cleanup: _gnutls_free_datum (&dn1); @@ -525,7 +556,8 @@ cleanup: * @issuer: is the certificate of a possible issuer * * This function will check if the given certificate was issued by the - * given issuer. + * given issuer. It checks the DN fields and the authority + * key identifier and subject key identifier fields match. * * Returns: It will return true (1) if the given certificate is issued * by the given issuer, and false (0) if not. A negative error code is |