Re: [PATCH] Enforce EKU requirements for client tokens during PKINIT

[Love Hörnquist Åstrand <lha@kth.se>]

18 mar 2008 kl. 14.50 skrev Timothy J Miller:

> On Mar 14, 2008, at 1:55 PM, Love Hörnquist Åstrand wrote:
>>
>> Ok, I just added a certificate selection language to heimdal's hx509.
>>
>> hxtool query \
>> 	--expr='"1.3.6.1.5.2.3.5" IN %{certificate.eku} AND % 
>> {certificate.subject} TAILMATCH "C=SE"'  \
>> 	FILE:$srcdir/data/kdc.crt > /dev/null || exit 1
>>
>> Would this do ?
>
> How rich is this expression allowed to be?

Variables are really trees and, matching on a level of the subtrees  
(keyword IN) is possible.

4.3 Matching syntax
===================

This is the language definitions somewhat slopply descriped:


      expr = TRUE,
           FALSE,
           ! expr,
           expr AND expr,
           expr OR expr,
           ( expr )
           compare

      compare =
           word == word,
           word != word,
           word IN ( word [, word ...])
           word IN %{variable.subvariable}

      word =
           STRING,
           %{variable}


Love