[libvirt] [PATCH] Add sanity checking of basic contraints, key purpose & key usage

Eric Blake eblake at redhat.com
Fri Jul 15 19:46:50 UTC 2011


On 07/15/2011 05:57 AM, Daniel P. Berrange wrote:
> Gnutls requires that certificates have basic constraints present
> to be used as a CA certificate. OpenSSL doesn't add this data
> by default, so add a sanity check to catch this situation. Also
> validate that the key usage and key purpose constraints contain
> correct data
> 
> * src/rpc/virnettlscontext.c: Add sanity checking of certificate
>   constraints
> ---
>  src/rpc/virnettlscontext.c |  130 ++++++++++++++++++++++++++++++++++++++++++--
>  1 files changed, 126 insertions(+), 4 deletions(-)

Seems like a reasonable thing to do.

> @@ -145,6 +154,117 @@ static gnutls_x509_crt_t virNetTLSContextSanityCheckCert(bool isServer,
>          goto cleanup;
>      }
>  
> +    status = gnutls_x509_crt_get_basic_constraints(cert, NULL, NULL, NULL);
> +    VIR_DEBUG("Cert %s basic constraints %d", certFile, status);
> +
> +    if (status > 0) { /* It is a CA cert */
> +        if (!isCA) {
> +            virNetError(VIR_ERR_SYSTEM_ERROR,
> +                        _("The certificate %s basic constraints show a CA, but we need one for a %s"),
> +                        certFile, isServer ? "server" : "client");

That won't translate well.  It needs to be:

isServer ?
_("The certificate %s basic constraints show a CA, but we need one for a
server") :
_("The certificate %s basic constraints show a CA, but we need one for a
client") , certFile

> +
> +    if (usage & GNUTLS_KEY_KEY_CERT_SIGN) {
> +        if (!isCA) {
> +            virNetError(VIR_ERR_SYSTEM_ERROR,
> +                        _("Certificate %s usage is for certificate signing, but wanted a %s certificate"),
> +                        certFile, isServer ? "server" : "client");

Another one.

> +
> +        VIR_DEBUG("Key purpose %d %s", status, buffer);
> +        if (STREQ(buffer, GNUTLS_KP_TLS_WWW_SERVER)) {
> +            if (isCA || !isServer) {
> +                virNetError(VIR_ERR_SYSTEM_ERROR,
> +                            _("Certificate %s purpose is TLS server, but wanted a %s certificate"),
> +                            certFile, isCA ? "CA" : "TLS client");

Another one.

> +                goto cleanup;
> +            }
> +        } else if (STREQ(buffer, GNUTLS_KP_TLS_WWW_CLIENT)) {
> +            if (isCA || isServer) {
> +                virNetError(VIR_ERR_SYSTEM_ERROR,
> +                            _("Certificate %s purpose is TLS client, but wanted a %s certificate"),
> +                            certFile, isCA ? "CA" : "TLS server");
> +                goto cleanup;
> +            }
> +        } else if (STRNEQ(buffer, GNUTLS_KP_ANY)) {
> +            virNetError(VIR_ERR_SYSTEM_ERROR,
> +                        _("Certificate %s purpose is wrong, wanted a %s certificate"),
> +                        certFile, isCA ? "CA" : (isServer ? "TLS server" : "TLS client"));

two more.

ACK with translation string nits fixed.

-- 
Eric Blake   eblake at redhat.com    +1-801-349-2682
Libvirt virtualization library http://libvirt.org

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 620 bytes
Desc: OpenPGP digital signature
URL: <http://listman.redhat.com/archives/libvir-list/attachments/20110715/1000f11a/attachment-0001.sig>


More information about the libvir-list mailing list