Proxmox-Port/libtpms
1
0
Fork 0
mirror of https://github.com/stefanberger/libtpms synced 2026-08-09 00:57:35 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

rev164: Use multiple BOOLs to evaluate rather than single one

Browse Source 
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
This commit is contained in:
Stefan Berger 2021-02-22 16:49:08 -05:00 committed by Stefan Berger
parent ef0bc94f83
commit 3620198c54
1 changed files with 16 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
src/tpm2/X509_spt.c
View File

@ -204,25 +204,30 @@ X509ProcessExtensions(
X509GetExtensionBits(&extensionCtx, &value))
{
x509KeyUsageUnion keyUsage;
BOOL bad;
BOOL badSign;
BOOL badDecrypt;
BOOL badFixedTPM;
BOOL badRestricted;
keyUsage.integer = value;
// For KeyUsage:
// 1) 'sign' is SET if Key Usage includes signing
bad = (KEY_USAGE_SIGN.integer & keyUsage.integer) != 0
&& !IS_ATTRIBUTE(attributes, TPMA_OBJECT, sign);
badSign = ((KEY_USAGE_SIGN.integer & keyUsage.integer) != 0)
&& !IS_ATTRIBUTE(attributes, TPMA_OBJECT, sign);
// 2) 'decrypt' is SET if Key Usage includes decryption uses
bad = bad || ((KEY_USAGE_DECRYPT.integer & keyUsage.integer) != 0
&& !IS_ATTRIBUTE(attributes, TPMA_OBJECT, decrypt));
badDecrypt = ((KEY_USAGE_DECRYPT.integer & keyUsage.integer) != 0)
&& !IS_ATTRIBUTE(attributes, TPMA_OBJECT, decrypt);
// 3) 'fixedTPM' is SET if Key Usage is non-repudiation
bad = bad || (IS_ATTRIBUTE(keyUsage.x509, TPMA_X509_KEY_USAGE, nonrepudiation)
&& !IS_ATTRIBUTE(attributes, TPMA_OBJECT, fixedTPM));
badFixedTPM = IS_ATTRIBUTE(keyUsage.x509, TPMA_X509_KEY_USAGE,
nonrepudiation)
&& !IS_ATTRIBUTE(attributes, TPMA_OBJECT, fixedTPM);
// 4)'restricted' is SET if Key Usage is for key agreement.
bad = bad || (IS_ATTRIBUTE(keyUsage.x509, TPMA_X509_KEY_USAGE, keyAgreement)
&& !IS_ATTRIBUTE(attributes, TPMA_OBJECT, restricted));
if(bad)
badRestricted = IS_ATTRIBUTE(keyUsage.x509, TPMA_X509_KEY_USAGE, keyAgreement)
&& !IS_ATTRIBUTE(attributes, TPMA_OBJECT, restricted);
if(badSign || badDecrypt || badFixedTPM || badRestricted)
return TPM_RCS_VALUE;
}
}
else
// The KeyUsage extension is required
return TPM_RCS_VALUE;