The_Great_Archive/xca
1
0
Fork 0
mirror of https://github.com/chris2511/xca.git synced 2026-09-14 11:06:19 +05:00
Code Issues Actions Packages Projects Releases Wiki Activity

Improve behavior regarding additional OIDs

Browse Source 
Depending on the OpenSSL version some OIDs are known, some are not.
When reading "oids.txt" file and adding the new OID definitions:
 - Silently skip definitions that are 100% identical to the OpenSSL values.
 - Give a hint to change identifiers that are used for a different OID
 - Give a hint about definitions that differ to remove them from the file.
   Also accept them as Alias when reading dn.txt and eku.txt
This commit is contained in:
Christian Hohnstaedt 2018-01-31 20:15:07 +01:00
parent 77bd35e634
commit 8333482eef
5 changed files with 69 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
lib/func.cpp
View File

@ -318,7 +318,7 @@ QString OBJ_obj2QString(const ASN1_OBJECT *a, int no_name)
char buf[512];
int len;
len = OBJ_obj2txt(buf, 256, a, no_name);
len = OBJ_obj2txt(buf, sizeof buf, a, no_name);
openssl_error();
return QString::fromLatin1(buf, len);
}

68
lib/oid.cpp
View File

@ -17,6 +17,8 @@
int first_additional_oid = 0;
QMap<QString,const char*> oid_name_clash;
/* reads additional OIDs from a file: oid, sn, ln */
static void readOIDs(QString fname)
{
@ -37,24 +39,59 @@ static void readOIDs(QString fname)
if (pb.startsWith('#') || pb.size() == 0)
continue;
sl.clear();
sl = pb.split(':');
sl = pb.split(QRegExp("\\s*:\\s*"));
if (sl.count() != 3) {
XCA_WARN(QString("Error reading config file: ") + fname + " Line: " +
QString::number(line));
XCA_WARN(QObject::tr("Error reading config file %1 at line %2")
.arg(fname).arg(line));
fclose(fp);
return;
} else {
QByteArray oid = sl[0].trimmed().toLatin1();
QByteArray sn = sl[1].trimmed().toLatin1();
QByteArray ln = sl[2].trimmed().toLatin1();
bool differs = false;
QByteArray in_use, oid, sn, ln;
oid = sl[0].toLatin1();
sn = sl[1].toLatin1();
ln = sl[2].toLatin1();
int nid = OBJ_txt2nid(oid.constData());
if ((nid != NID_undef) && (sn != OBJ_nid2sn(nid))) {
printf("OID: '%s' SN differs: '%s' '%s'\n",
oid.constData(), sn.constData(),
OBJ_nid2sn(nid));
if (nid != NID_undef) {
if (sn != OBJ_nid2sn(nid)) {
printf("%s SN differs: '%s' '%s'\n",
oid.constData(), sn.constData(),
OBJ_nid2sn(nid));
oid_name_clash[sn] = OBJ_nid2sn(nid);
differs = true;
}
if (ln != OBJ_nid2ln(nid)) {
printf("%s LN differs: '%s' '%s'\n",
oid.constData(), ln.constData(),
OBJ_nid2ln(nid));
oid_name_clash[ln] = OBJ_nid2ln(nid);
differs = true;
}
} else {
if (OBJ_txt2nid(sn.constData()) != NID_undef)
in_use = sn;
if (OBJ_txt2nid(ln.constData()) != NID_undef)
in_use = ln;
}
if ((nid == NID_undef) || (sn != OBJ_nid2sn(nid))) {
ign_openssl_error();
if (differs) {
XCA_WARN(QObject::tr("The Object '%1' from file %2 line %3 is already known as '%4:%5:%6' and should be removed.")
.arg(sl.join(":")).arg(fname).arg(line)
.arg(OBJ_obj2QString(OBJ_nid2obj(nid), 1))
.arg(OBJ_nid2sn(nid)).arg(OBJ_nid2ln(nid))
);
} else if (!in_use.isEmpty()) {
nid = OBJ_txt2nid(in_use.constData());
XCA_WARN(QObject::tr("The identifier '%1' for OID %2 from file %3 line %4 is already used for a different OID as '%5:%6:%7' and should be changed to avoid conflicts.")
.arg(in_use.constData())
.arg(oid.constData())
.arg(fname).arg(line)
.arg(OBJ_obj2QString(OBJ_nid2obj(nid), 1))
.arg(OBJ_nid2sn(nid)).arg(OBJ_nid2ln(nid))
);
} else {
OBJ_create(oid.constData(), sn.constData(),
ln.constData());
}
@ -87,7 +124,7 @@ void initOIDs()
NIDlist readNIDlist(QString fname)
{
char buff[128];
const char *pb;
const char *pb, *userdefined;
char *pbe;
FILE *fp;
int line = 0, nid;
@ -104,10 +141,13 @@ NIDlist readNIDlist(QString fname)
while (*pbe == ' ' || *pbe == '\t' || *pbe == '\r' || *pbe == '\n')
*pbe-- = '\0';
userdefined = oid_name_clash[QString(pb)];
if (userdefined)
pb = userdefined;
nid = OBJ_txt2nid((char *)pb);
if (nid == NID_undef)
XCA_WARN(QString("Unknown (flying:-) Object: ") + fname +
" Line: " + QString::number(line));
XCA_WARN(QObject::tr("Unknown object '%1' in file %2 line %3")
.arg(pb).arg(fname).arg(line));
else
nl += nid;
}

2
lib/oid.h
View File

@ -10,8 +10,10 @@
class QString;
#include <QList>
#include <QMap>
extern int first_additional_oid;
extern QMap<QString,const char*> oid_name_clash;
typedef QList<int> NIDlist;
/* reads additional OIDs from a file: oid, sn, ln */

12
misc/oids.txt
View File

@ -7,14 +7,14 @@
1.3.6.1.4.1.311.20.2.3: msUPN: Microsoft Universal Principal Name
1.3.6.1.4.1.311.10.3.4.1:msEFSFR: Microsoft EFS File Recovery
1.3.6.1.5.5.8.2.2: iKEIntermediate: IP security end entity
1.3.6.1.5.5.7.3.1: serverAuth: Microsoft Server
1.3.6.1.5.5.7.3.2: clientAuth: Microsoft Client
1.3.6.1.4.1.311.20.2.2: msSmartcardLogin: Smart Card Logon
2.5.4.44: generationQualifier: generation Qualifier
2.5.4.45: x500UniqueIdentifier: x500 Unique Identifier
1.3.6.1.5.5.7.3.1: serverAuth: TLS Web Server Authentication
1.3.6.1.5.5.7.3.2: clientAuth: TLS Web Client Authentication
1.3.6.1.4.1.311.20.2.2: msSmartcardLogin: Microsoft Smartcardlogin
2.5.4.44: generationQualifier: generationQualifier
2.5.4.45: x500UniqueIdentifier: x500UniqueIdentifier
2.5.4.65: pseudonym: pseudonym
0.2.262.1.10.7.20: nameDistinguisher: Name distinguisher
# RFC 4334
1.3.6.1.5.5.7.3.13: id-kp-eapOverPPP: EAP over PPP
1.3.6.1.5.5.7.3.14: id-kp-eapOverLAN: EAP over Lan
1.3.6.1.5.2.3.5: pkInitKDC: KDC Authentication
1.3.6.1.5.2.3.5: pkInitKDC: Signing KDC Response

6
widgets/OidResolver.cpp
View File

@ -7,6 +7,7 @@
#include <openssl/objects.h>
#include "OidResolver.h"
#include "lib/oid.h"
#include "lib/base.h"
#include "lib/func.h"
#include "lib/exception.h"
@ -29,6 +30,11 @@ void OidResolver::searchOid(QString s)
n = s.toUInt(&ok);
if (!ok)
n = OBJ_txt2nid(CCHAR(s));
if (n == NID_undef) {
const char *clash = oid_name_clash[s];
if (clash)
n = OBJ_txt2nid(clash);
}
ign_openssl_error();
if (n == NID_undef) {
ln->clear();