From 60ca584266743c17895e8cb03ef407a5d1ffa3bb Mon Sep 17 00:00:00 2001
From: Christian Hohnstaedt <christian@hohnstaedt.de>
Date: Fri, 6 Sep 2024 09:27:16 +0200
Subject: [PATCH] Close #315 Support UPN type for EAP/802.1X certificates

Replace "UPN:" by "otherName:msUPN;UTF8:" when generating
the extension from the Subject- and IssuerAlternativeName.

Extend the Edit dialog of the SAN and IAN by the "UPN" prefix.

Replace "otherName:msUPN;UTF8:" by "UPN:" when creating a template
from an existing certificate or request.

The OpenSSL config file export, the configuration display
and edit on the "Advanced Tab" are not afffected, since
this is an XCA syntax sugar, not supported by OpenSSL.

Update documentation
---
 doc/rst/certificate-input.rst | 5 ++++-
 lib/pki_temp.cpp              | 9 +++++++++
 lib/x509v3ext.cpp             | 9 +++++++++
 widgets/NewX509.cpp           | 4 ++--
 4 files changed, 24 insertions(+), 3 deletions(-)

diff --git a/doc/rst/certificate-input.rst b/doc/rst/certificate-input.rst
index c6250e26..60e112cf 100644
--- a/doc/rst/certificate-input.rst
+++ b/doc/rst/certificate-input.rst
@@ -147,7 +147,10 @@ Subject Alternative Name
 ........................
 
 The subject alternative name accepts a special entry *DNS:copycn*.
-This will copy the *commonName* entry frome th subject as DNS entry.
+This will copy all *commonName* entries from the subject as DNS entries.
+
+Together with the issuer alternative name it accepts the special entry *UPN:*
+as short form of *otherName:msUPN;UTF8:*
 
 .. index:: wizard_advanced (wizard_advanced)
 
diff --git a/lib/pki_temp.cpp b/lib/pki_temp.cpp
index 2dfab297..cd73ea1b 100644
--- a/lib/pki_temp.cpp
+++ b/lib/pki_temp.cpp
@@ -192,6 +192,15 @@ void pki_temp::fromExtList(extList *el, int nid, const char *item)
 {
 	QString target;
 	el->genConf(nid, &target, &adv_ext);
+	if (nid == NID_subject_alt_name || nid == NID_issuer_alt_name) {
+		QStringList sl = target.split(",");
+		for (int i=0; i<sl.size(); i++) {
+			QString s = sl[i].trimmed();
+			if (s.startsWith("otherName:msUPN;UTF8:"))
+				sl[i] = s.replace("otherName:msUPN;UTF8:", "UPN:");
+		}
+		target = sl.join(",");
+	}
 	settings[item] = target;
 }
 
diff --git a/lib/x509v3ext.cpp b/lib/x509v3ext.cpp
index 7910527b..4f57ecb6 100644
--- a/lib/x509v3ext.cpp
+++ b/lib/x509v3ext.cpp
@@ -83,6 +83,15 @@ x509v3ext &x509v3ext::create(int nid, const QString &et, X509V3_CTX *ctx)
 			if (new_san.size() > 0)
 				etext.replace(QString("DNS:copycn"), new_san.join(","));
 		}
+		if (nid == NID_subject_alt_name || nid == NID_issuer_alt_name) {
+			QStringList sl = etext.split(",");
+			for (int i=0; i<sl.size(); i++) {
+				QString s = sl[i].trimmed();
+				if (s.startsWith("UPN:"))
+					sl[i] = s.replace("UPN:", "otherName:msUPN;UTF8:");
+			}
+			etext = sl.join(",");
+		}
 		QByteArray ba = etext.toLocal8Bit();
 		ext = X509V3_EXT_conf_nid(NULL, ctx, nid, ba.data());
 	}
diff --git a/widgets/NewX509.cpp b/widgets/NewX509.cpp
index ad1aa30a..4c6ce49f 100644
--- a/widgets/NewX509.cpp
+++ b/widgets/NewX509.cpp
@@ -1125,13 +1125,13 @@ enum NewX509::extension_error NewX509::validateExtensions(QString &result)
 
 void NewX509::on_editSubAlt_clicked()
 {
-	QString s = "URI,email,RID,DNS,IP,otherName";
+	QString s = "URI,email,RID,DNS,IP,UPN,otherName";
 	editV3ext(subAltName, s, NID_subject_alt_name);
 }
 
 void NewX509::on_editIssAlt_clicked()
 {
-	QString s = "URI,email,RID,DNS,IP,otherName,issuer";
+	QString s = "URI,email,RID,DNS,IP,UPN,otherName,issuer";
 	editV3ext(issAltName, s, NID_issuer_alt_name);
 }