From: Dr. Stephen Henson <steve@openssl.org>
Date: Fri, 6 Apr 2012 11:36:35 +0000 (+0000)
Subject: Backport: allow key agreement in SSL/TLS certificates (from HEAD)
X-Git-Tag: OpenSSL_1_0_2-beta1~691
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=0cb9dbed4e131c83fcd3ac683294def87f566695;p=oweals%2Fopenssl.git

Backport: allow key agreement in SSL/TLS certificates (from HEAD)
---

diff --git a/crypto/x509v3/v3_purp.c b/crypto/x509v3/v3_purp.c
index 181bd34979..ae41a71481 100644
--- a/crypto/x509v3/v3_purp.c
+++ b/crypto/x509v3/v3_purp.c
@@ -553,12 +553,18 @@ static int check_purpose_ssl_client(const X509_PURPOSE *xp, const X509 *x, int c
 {
 	if(xku_reject(x,XKU_SSL_CLIENT)) return 0;
 	if(ca) return check_ssl_ca(x);
-	/* We need to do digital signatures with it */
-	if(ku_reject(x,KU_DIGITAL_SIGNATURE)) return 0;
+	/* We need to do digital signatures or key agreement */
+	if(ku_reject(x,KU_DIGITAL_SIGNATURE|KU_KEY_AGREEMENT)) return 0;
 	/* nsCertType if present should allow SSL client use */	
 	if(ns_reject(x, NS_SSL_CLIENT)) return 0;
 	return 1;
 }
+/* Key usage needed for TLS/SSL server: digital signature, encipherment or
+ * key agreement. The ssl code can check this more thoroughly for individual
+ * key types.
+ */
+#define KU_TLS \
+	KU_DIGITAL_SIGNATURE|KU_KEY_ENCIPHERMENT|KU_KEY_AGREEMENT
 
 static int check_purpose_ssl_server(const X509_PURPOSE *xp, const X509 *x, int ca)
 {
@@ -566,8 +572,7 @@ static int check_purpose_ssl_server(const X509_PURPOSE *xp, const X509 *x, int c
 	if(ca) return check_ssl_ca(x);
 
 	if(ns_reject(x, NS_SSL_SERVER)) return 0;
-	/* Now as for keyUsage: we'll at least need to sign OR encipher */
-	if(ku_reject(x, KU_DIGITAL_SIGNATURE|KU_KEY_ENCIPHERMENT)) return 0;
+	if(ku_reject(x, KU_TLS)) return 0;
 	
 	return 1;