x509-validation 1.4.6 → 1.4.7

raw patch · 2 files changed

+30/−10 lines, 2 filesdep ~x509

Dependency ranges changed: x509

Files

• Data/X509/Validation.hs +28/−8
• x509-validation.cabal +2/−2

@@ -44,6 +44,7 @@     | NameMismatch String      -- ^ connection name and certificate do not match     | InvalidWildcard          -- ^ invalid wildcard in certificate     | LeafKeyUsageNotAllowed   -- ^ the requested key usage is not compatible with the leaf certificate's key usage+    | LeafKeyPurposeNotAllowed -- ^ the requested key purpose is not compatible with the leaf certificate's extended key usage     | LeafNotV3                -- ^ Only authorized an X509.V3 certificate as leaf certificate.     | EmptyChain               -- ^ empty chain of certificate     deriving (Show,Eq)@@ -76,8 +77,16 @@     , checkLeafV3         :: Bool     -- | Check that the leaf certificate is authorized to be used for certain usage.     -- If set to empty list no check are performed, otherwise all the flags is the list-    -- need to exists in the key usage extension+    -- need to exists in the key usage extension. If the extension is not present,+    -- the check will pass and behave as if the certificate key is not restricted to+    -- any specific usage.     , checkLeafKeyUsage   :: [ExtKeyUsageFlag]+    -- | Check that the leaf certificate is authorized to be used for certain purpose.+    -- If set to empty list no check are performed, otherwise all the flags is the list+    -- need to exists in the extended key usage extension if present. If the extension is not+    -- present, then the check will pass and behave as if the certificate is not restricted+    -- to any specific purpose.+    , checkLeafKeyPurpose :: [ExtKeyUsagePurpose]     -- | Check the top certificate names matching the fully qualified hostname (FQHN).     -- it's not recommended to turn this check off, if no other name checks are performed.     , checkFQHN           :: Maybe String@@ -100,7 +109,8 @@     , checkCAConstraints  = True     , checkExhaustive     = False     , checkLeafV3         = True-    , checkLeafKeyUsage   = [KeyUsage_keyEncipherment]+    , checkLeafKeyUsage   = []+    , checkLeafKeyPurpose = []     , checkFQHN           = fqhn     } @@ -177,12 +187,22 @@             | otherwise = return []          doKeyUsageCheck cert = return $-            case (certVersion cert, checkLeafKeyUsage checks) of-                (2, usage) -> if intersect usage flags == usage then [] else [LeafKeyUsageNotAllowed]-                _          -> []-          where flags = case extensionGet $ certExtensions cert of-                            Just (ExtKeyUsage keyflags) -> keyflags-                            Nothing                     -> []+               compareListIfExistAndNotNull mflags (checkLeafKeyUsage checks) LeafKeyUsageNotAllowed+            ++ compareListIfExistAndNotNull mpurposes (checkLeafKeyPurpose checks) LeafKeyPurposeNotAllowed+          where mflags = case extensionGet $ certExtensions cert of+                            Just (ExtKeyUsage keyflags) -> Just keyflags+                            Nothing                     -> Nothing+                mpurposes = case extensionGet $ certExtensions cert of+                            Just (ExtExtendedKeyUsage keyPurposes) -> Just keyPurposes+                            Nothing                                -> Nothing+                -- compare a list of things to an expected list. the expected list+                -- need to be a subset of the list (if not Nothing), and is not will+                -- return [err]+                compareListIfExistAndNotNull Nothing     _        _   = []+                compareListIfExistAndNotNull (Just list) expected err+                    | null expected                       = []+                    | intersect expected list == expected = []+                    | otherwise                           = [err]          doCheckCertificate cert =             exhaustiveList (checkExhaustive checks)

@@ -1,5 +1,5 @@ Name:                x509-validation-Version:             1.4.6+Version:             1.4.7 Description:         X.509 Certificate and CRL validation License:             BSD3 License-file:        LICENSE@@ -25,7 +25,7 @@                    , pem >= 0.1 && < 0.3                    , asn1-types >= 0.2 && < 0.3                    , asn1-encoding >= 0.8 && < 0.9-                   , x509 >= 1.4.2 && < 1.5+                   , x509 >= 1.4.7 && < 1.5                    , x509-store >= 1.4 && < 1.5                    , crypto-pubkey >= 0.1.4 && < 0.3                    , crypto-pubkey-types >= 0.4 && < 0.5