From 8333482eeff0da5c3d0deba40066873e40ffbdaf Mon Sep 17 00:00:00 2001 From: Christian Hohnstaedt Date: Wed, 31 Jan 2018 20:15:07 +0100 Subject: [PATCH] Improve behavior regarding additional OIDs Depending on the OpenSSL version some OIDs are known, some are not. When reading "oids.txt" file and adding the new OID definitions: - Silently skip definitions that are 100% identical to the OpenSSL values. - Give a hint to change identifiers that are used for a different OID - Give a hint about definitions that differ to remove them from the file. Also accept them as Alias when reading dn.txt and eku.txt --- lib/func.cpp | 2 +- lib/oid.cpp | 68 ++++++++++++++++++++++++++++++++--------- lib/oid.h | 2 ++ misc/oids.txt | 12 ++++---- widgets/OidResolver.cpp | 6 ++++ 5 files changed, 69 insertions(+), 21 deletions(-) diff --git a/lib/func.cpp b/lib/func.cpp index a33ec85d..1145d80d 100644 --- a/lib/func.cpp +++ b/lib/func.cpp @@ -318,7 +318,7 @@ QString OBJ_obj2QString(const ASN1_OBJECT *a, int no_name) char buf[512]; int len; - len = OBJ_obj2txt(buf, 256, a, no_name); + len = OBJ_obj2txt(buf, sizeof buf, a, no_name); openssl_error(); return QString::fromLatin1(buf, len); } diff --git a/lib/oid.cpp b/lib/oid.cpp index 4de07e43..138b9be7 100644 --- a/lib/oid.cpp +++ b/lib/oid.cpp @@ -17,6 +17,8 @@ int first_additional_oid = 0; +QMap oid_name_clash; + /* reads additional OIDs from a file: oid, sn, ln */ static void readOIDs(QString fname) { @@ -37,24 +39,59 @@ static void readOIDs(QString fname) if (pb.startsWith('#') || pb.size() == 0) continue; sl.clear(); - sl = pb.split(':'); + sl = pb.split(QRegExp("\\s*:\\s*")); if (sl.count() != 3) { - XCA_WARN(QString("Error reading config file: ") + fname + " Line: " + - QString::number(line)); + XCA_WARN(QObject::tr("Error reading config file %1 at line %2") + .arg(fname).arg(line)); fclose(fp); return; } else { - QByteArray oid = sl[0].trimmed().toLatin1(); - QByteArray sn = sl[1].trimmed().toLatin1(); - QByteArray ln = sl[2].trimmed().toLatin1(); + bool differs = false; + QByteArray in_use, oid, sn, ln; + + oid = sl[0].toLatin1(); + sn = sl[1].toLatin1(); + ln = sl[2].toLatin1(); int nid = OBJ_txt2nid(oid.constData()); - if ((nid != NID_undef) && (sn != OBJ_nid2sn(nid))) { - printf("OID: '%s' SN differs: '%s' '%s'\n", - oid.constData(), sn.constData(), - OBJ_nid2sn(nid)); + if (nid != NID_undef) { + if (sn != OBJ_nid2sn(nid)) { + printf("%s SN differs: '%s' '%s'\n", + oid.constData(), sn.constData(), + OBJ_nid2sn(nid)); + oid_name_clash[sn] = OBJ_nid2sn(nid); + differs = true; + } + if (ln != OBJ_nid2ln(nid)) { + printf("%s LN differs: '%s' '%s'\n", + oid.constData(), ln.constData(), + OBJ_nid2ln(nid)); + oid_name_clash[ln] = OBJ_nid2ln(nid); + differs = true; + } + } else { + if (OBJ_txt2nid(sn.constData()) != NID_undef) + in_use = sn; + if (OBJ_txt2nid(ln.constData()) != NID_undef) + in_use = ln; } - if ((nid == NID_undef) || (sn != OBJ_nid2sn(nid))) { + ign_openssl_error(); + if (differs) { + XCA_WARN(QObject::tr("The Object '%1' from file %2 line %3 is already known as '%4:%5:%6' and should be removed.") + .arg(sl.join(":")).arg(fname).arg(line) + .arg(OBJ_obj2QString(OBJ_nid2obj(nid), 1)) + .arg(OBJ_nid2sn(nid)).arg(OBJ_nid2ln(nid)) + ); + } else if (!in_use.isEmpty()) { + nid = OBJ_txt2nid(in_use.constData()); + XCA_WARN(QObject::tr("The identifier '%1' for OID %2 from file %3 line %4 is already used for a different OID as '%5:%6:%7' and should be changed to avoid conflicts.") + .arg(in_use.constData()) + .arg(oid.constData()) + .arg(fname).arg(line) + .arg(OBJ_obj2QString(OBJ_nid2obj(nid), 1)) + .arg(OBJ_nid2sn(nid)).arg(OBJ_nid2ln(nid)) + ); + } else { OBJ_create(oid.constData(), sn.constData(), ln.constData()); } @@ -87,7 +124,7 @@ void initOIDs() NIDlist readNIDlist(QString fname) { char buff[128]; - const char *pb; + const char *pb, *userdefined; char *pbe; FILE *fp; int line = 0, nid; @@ -104,10 +141,13 @@ NIDlist readNIDlist(QString fname) while (*pbe == ' ' || *pbe == '\t' || *pbe == '\r' || *pbe == '\n') *pbe-- = '\0'; + userdefined = oid_name_clash[QString(pb)]; + if (userdefined) + pb = userdefined; nid = OBJ_txt2nid((char *)pb); if (nid == NID_undef) - XCA_WARN(QString("Unknown (flying:-) Object: ") + fname + - " Line: " + QString::number(line)); + XCA_WARN(QObject::tr("Unknown object '%1' in file %2 line %3") + .arg(pb).arg(fname).arg(line)); else nl += nid; } diff --git a/lib/oid.h b/lib/oid.h index 89cc55cb..26f21a9b 100644 --- a/lib/oid.h +++ b/lib/oid.h @@ -10,8 +10,10 @@ class QString; #include +#include extern int first_additional_oid; +extern QMap oid_name_clash; typedef QList NIDlist; /* reads additional OIDs from a file: oid, sn, ln */ diff --git a/misc/oids.txt b/misc/oids.txt index 93ca461c..7a1ee741 100644 --- a/misc/oids.txt +++ b/misc/oids.txt @@ -7,14 +7,14 @@ 1.3.6.1.4.1.311.20.2.3: msUPN: Microsoft Universal Principal Name 1.3.6.1.4.1.311.10.3.4.1:msEFSFR: Microsoft EFS File Recovery 1.3.6.1.5.5.8.2.2: iKEIntermediate: IP security end entity -1.3.6.1.5.5.7.3.1: serverAuth: Microsoft Server -1.3.6.1.5.5.7.3.2: clientAuth: Microsoft Client -1.3.6.1.4.1.311.20.2.2: msSmartcardLogin: Smart Card Logon -2.5.4.44: generationQualifier: generation Qualifier -2.5.4.45: x500UniqueIdentifier: x500 Unique Identifier +1.3.6.1.5.5.7.3.1: serverAuth: TLS Web Server Authentication +1.3.6.1.5.5.7.3.2: clientAuth: TLS Web Client Authentication +1.3.6.1.4.1.311.20.2.2: msSmartcardLogin: Microsoft Smartcardlogin +2.5.4.44: generationQualifier: generationQualifier +2.5.4.45: x500UniqueIdentifier: x500UniqueIdentifier 2.5.4.65: pseudonym: pseudonym 0.2.262.1.10.7.20: nameDistinguisher: Name distinguisher # RFC 4334 1.3.6.1.5.5.7.3.13: id-kp-eapOverPPP: EAP over PPP 1.3.6.1.5.5.7.3.14: id-kp-eapOverLAN: EAP over Lan -1.3.6.1.5.2.3.5: pkInitKDC: KDC Authentication +1.3.6.1.5.2.3.5: pkInitKDC: Signing KDC Response diff --git a/widgets/OidResolver.cpp b/widgets/OidResolver.cpp index 99bc5763..fa954256 100644 --- a/widgets/OidResolver.cpp +++ b/widgets/OidResolver.cpp @@ -7,6 +7,7 @@ #include #include "OidResolver.h" +#include "lib/oid.h" #include "lib/base.h" #include "lib/func.h" #include "lib/exception.h" @@ -29,6 +30,11 @@ void OidResolver::searchOid(QString s) n = s.toUInt(&ok); if (!ok) n = OBJ_txt2nid(CCHAR(s)); + if (n == NID_undef) { + const char *clash = oid_name_clash[s]; + if (clash) + n = OBJ_txt2nid(clash); + } ign_openssl_error(); if (n == NID_undef) { ln->clear();