aboutsummaryrefslogtreecommitdiffstats
path: root/package
diff options
context:
space:
mode:
authorSergey V. Lobanov <sergey@lobanov.in>2021-12-25 02:05:35 +0300
committerChristian Lamparter <chunkeey@gmail.com>2021-12-29 22:55:16 +0100
commit6bfc8bb4a37903bd1d3bb7e7824d89f3a2cca6a1 (patch)
tree9b0e2b3623854117e02e995108bcfad8fe40c9a8 /package
parentdfd695f4b9f364a7c7db646d2cada10fdf304f02 (diff)
downloadupstream-6bfc8bb4a37903bd1d3bb7e7824d89f3a2cca6a1.tar.gz
upstream-6bfc8bb4a37903bd1d3bb7e7824d89f3a2cca6a1.tar.bz2
upstream-6bfc8bb4a37903bd1d3bb7e7824d89f3a2cca6a1.zip
utils/px5g-wolfssl: make selfsigned certicates compatible with chromium
Chromium based web-browsers (version >58) checks x509v3 extended attributes. If this check fails then chromium does not allow to click "Proceed to ... (unsafe)" link. This patch add three x509v3 extended attributes to self-signed certificate: 1. SAN (Subject Alternative Name) (DNS Name) = CN (common name) 2. Key Usage = Digital Signature, Non Repudiation, Key Encipherment 3. Extended Key Usage = TLS Web Server Authentication SAN will be added only if CONFIG_WOLFSSL_ALT_NAMES=y Signed-off-by: Sergey V. Lobanov <sergey@lobanov.in>
Diffstat (limited to 'package')
-rw-r--r--package/utils/px5g-wolfssl/Makefile2
-rw-r--r--package/utils/px5g-wolfssl/px5g-wolfssl.c20
2 files changed, 21 insertions, 1 deletions
diff --git a/package/utils/px5g-wolfssl/Makefile b/package/utils/px5g-wolfssl/Makefile
index 90296008d6..95517c5c00 100644
--- a/package/utils/px5g-wolfssl/Makefile
+++ b/package/utils/px5g-wolfssl/Makefile
@@ -12,6 +12,8 @@ PKG_USE_MIPS16:=0
PKG_MAINTAINER:=Paul Spooren <mail@aparcar.org>
+PKG_CONFIG_DEPENDS:=CONFIG_WOLFSSL_ALT_NAMES
+
include $(INCLUDE_DIR)/package.mk
define Package/px5g-wolfssl
diff --git a/package/utils/px5g-wolfssl/px5g-wolfssl.c b/package/utils/px5g-wolfssl/px5g-wolfssl.c
index 763d7b4b71..86227d6afd 100644
--- a/package/utils/px5g-wolfssl/px5g-wolfssl.c
+++ b/package/utils/px5g-wolfssl/px5g-wolfssl.c
@@ -203,8 +203,23 @@ int selfsigned(WC_RNG *rng, char **arg) {
strncpy(newCert.subject.org, val, CTC_NAME_SIZE);
else if (!strcmp(key, "OU"))
strncpy(newCert.subject.unit, val, CTC_NAME_SIZE);
- else if (!strcmp(key, "CN"))
+ else if (!strcmp(key, "CN")) {
strncpy(newCert.subject.commonName, val, CTC_NAME_SIZE);
+
+#ifdef WOLFSSL_ALT_NAMES
+ if(strlen(val) + 2 > 256) {
+ fprintf(stderr, "error: CN is too long: %s\n", val);
+ return 1;
+ }
+
+ newCert.altNames[0] = 0x30; //Sequence with one element
+ newCert.altNames[1] = strlen(val) + 2; // Length of entire sequence
+ newCert.altNames[2] = 0x82; //8 - String, 2 - DNS Name
+ newCert.altNames[3] = strlen(val); //DNS Name length
+ memcpy(newCert.altNames + 4, val, strlen(val)); //DNS Name
+ newCert.altNamesSz = strlen(val) + 4;
+#endif
+ }
else if (!strcmp(key, "EMAIL"))
strncpy(newCert.subject.email, val, CTC_NAME_SIZE);
else
@@ -216,6 +231,9 @@ int selfsigned(WC_RNG *rng, char **arg) {
}
newCert.daysValid = days;
+ newCert.keyUsage = KEYUSE_DIGITAL_SIG | KEYUSE_CONTENT_COMMIT | KEYUSE_KEY_ENCIPHER;
+ newCert.extKeyUsage = EXTKEYUSE_SERVER_AUTH;
+
gen_key(rng, &ecKey, &rsaKey, type, keySz, exp, curve);
write_key(&ecKey, &rsaKey, type, keySz, keypath, pem);