livie
/
phoenix-firestorm
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

SL-13921 Only one of extended key usages is needed 

LN (EKU_TLS) is more likely to be present thus should be checked first
meow-7.2.2
Andrey Kleshchev 2020-09-09 18:05:11 +03:00
parent d50131c0ac
commit 4eefce9767
1 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
indra/newview/llsechandler_basic.cpp
View File

@ -924,12 +924,13 @@ void _validateCert(int validation_policy,
LLTHROW(LLCertKeyUsageValidationException(current_cert_info));
}
// only validate EKU if the cert has it
if(current_cert_info.has(CERT_EXTENDED_KEY_USAGE) && current_cert_info[CERT_EXTENDED_KEY_USAGE].isArray() &&
( (!_LLSDArrayIncludesValue(current_cert_info[CERT_EXTENDED_KEY_USAGE],
if(current_cert_info.has(CERT_EXTENDED_KEY_USAGE)
&& current_cert_info[CERT_EXTENDED_KEY_USAGE].isArray()
&& (!_LLSDArrayIncludesValue(current_cert_info[CERT_EXTENDED_KEY_USAGE],
LLSD((std::string)CERT_EKU_TLS_SERVER_AUTH)))
&& (!_LLSDArrayIncludesValue(current_cert_info[CERT_EXTENDED_KEY_USAGE],
LLSD((std::string)CERT_EKU_SERVER_AUTH)))
|| (!_LLSDArrayIncludesValue(current_cert_info[CERT_EXTENDED_KEY_USAGE],
LLSD((std::string)CERT_EKU_TLS_SERVER_AUTH)))
))
)
{
LLTHROW(LLCertKeyUsageValidationException(current_cert_info));
}