Commit 3a5914c6 authored by Alex Guzman's avatar Alex Guzman Committed by Facebook Github Bot

Fix portable versions of X509_get_extension_flags and X509_get_key_usage

Summary:
These two functions are currently not correctly implemented when compared to the documented behavior.

1. These functions aren't guaranteed to return correct information until you've called X509_check_purpose on the certificate. Before then, these flag fields are uninitialized.
2. X509_get_key_usage should return UINT32_MAX when the key usage flag isn't present.

This fixes both of these issues

Reviewed By: yfeldblum

Differential Revision: D15767405

fbshipit-source-id: 013bc4c2f694ba7cbd7395626418a0d423d6c1c7
parent 125e0ed6
...@@ -489,11 +489,18 @@ const ASN1_TIME* X509_REVOKED_get0_revocationDate(const X509_REVOKED* r) { ...@@ -489,11 +489,18 @@ const ASN1_TIME* X509_REVOKED_get0_revocationDate(const X509_REVOKED* r) {
} }
uint32_t X509_get_extension_flags(X509* x) { uint32_t X509_get_extension_flags(X509* x) {
// Tells OpenSSL to load flags
X509_check_purpose(x, -1, -1);
return x->ex_flags; return x->ex_flags;
} }
uint32_t X509_get_key_usage(X509* x) { uint32_t X509_get_key_usage(X509* x) {
return x->ex_kusage; // Call get_extension_flags rather than accessing directly to force loading
// of flags
if (X509_get_extension_flags(x) & EXFLAG_KUSAGE == EXFLAG_KUSAGE) {
return x->ex_kusage;
}
return UINT32_MAX;
} }
uint32_t X509_get_extended_key_usage(X509* x) { uint32_t X509_get_extended_key_usage(X509* x) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment