diff options
| author | Greg Hudson <ghudson@mit.edu> | 2010-09-15 17:10:05 +0000 |
|---|---|---|
| committer | Greg Hudson <ghudson@mit.edu> | 2010-09-15 17:10:05 +0000 |
| commit | 4bcc98813080a3dabb94e31e974a6f74a81b2125 (patch) | |
| tree | 92096245e25121483e646149093636edf7c1c702 /src/plugins/preauth | |
| parent | d746c242ce4b439c10966909bd362daf3ddeae41 (diff) | |
| download | krb5-4bcc98813080a3dabb94e31e974a6f74a81b2125.tar.gz krb5-4bcc98813080a3dabb94e31e974a6f74a81b2125.tar.xz krb5-4bcc98813080a3dabb94e31e974a6f74a81b2125.zip | |
In the PKINIT OpenSSL code, ensure that appropriate cerficiate fields
have been set before using ku_reject. Patch from nalin@redhat.com.
ticket: 6775
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24313 dc483132-0cff-0310-8789-dd5450dbe970
Diffstat (limited to 'src/plugins/preauth')
| -rw-r--r-- | src/plugins/preauth/pkinit/pkinit_crypto_openssl.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c index c1d87c8ca..a109a6797 100644 --- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c @@ -2005,6 +2005,7 @@ crypto_check_cert_eku(krb5_context context, pkiDebug("%s: found acceptable EKU, checking for digitalSignature\n", __FUNCTION__); /* check that digitalSignature KeyUsage is present */ + X509_check_ca(reqctx->received_cert); if ((usage = X509_get_ext_d2i(reqctx->received_cert, NID_key_usage, NULL, NULL))) { @@ -4551,6 +4552,7 @@ check_kus: } /* Make sure usage exists before checking bits */ + X509_check_ca(x); usage = X509_get_ext_d2i(x, NID_key_usage, NULL, NULL); if (usage) { if (!ku_reject(x, X509v3_KU_DIGITAL_SIGNATURE)) |