Merge pull request #2569 from smallstep/mariano/check-eku-size

Validate tcg-kp-AIKCertificate EKU

Author: maraino

acme/challenge.go

@@ -1250,7 +1250,7 @@ func validateAKCertificateExtendedKeyUsage(c *x509.Certificate) error {
 	)
 	for _, ext := range c.Extensions {
 		if ext.Id.Equal(oidExtensionExtendedKeyUsage) {
-			if _, err := asn1.Unmarshal(ext.Value, &ekus); err != nil || !ekus[0].Equal(oidTCGKpAIKCertificate) {
+			if _, err := asn1.Unmarshal(ext.Value, &ekus); err != nil || len(ekus) == 0 || !ekus[0].Equal(oidTCGKpAIKCertificate) {
 				return errors.New("AK certificate is missing Extended Key Usage value tcg-kp-AIKCertificate (2.23.133.8.3)")
 			}
 			valid = true

acme/challenge_test.go

@@ -5115,13 +5115,23 @@ func Test_validateAKCertificateExtendedKeyUsage(t *testing.T) {
 	require.NoError(t, err)
 	wrongEKU, err := ca.Sign(template)
 	require.NoError(t, err)
+	emptyEKU, err := ca.Sign(&x509.Certificate{
+		PublicKey: signer.Public(),
+		ExtraExtensions: []pkix.Extension{{
+			Id:    oidExtensionExtendedKeyUsage,
+			Value: []byte{0x30, 0x00}, // DER: empty SEQUENCE
+		}},
+	})
+	require.NoError(t, err)
+
 	tests := []struct {
 		name   string
 		c      *x509.Certificate
 		expErr error
 	}{
 		{"ok", ok, nil},
 		{"fail/wrong-eku", wrongEKU, errors.New("AK certificate is missing Extended Key Usage value tcg-kp-AIKCertificate (2.23.133.8.3)")},
+		{"fail/empty-eku", emptyEKU, errors.New("AK certificate is missing Extended Key Usage value tcg-kp-AIKCertificate (2.23.133.8.3)")},
 		{"fail/missing-eku", missingEKU, errors.New("AK certificate is missing Extended Key Usage extension")},
 	}
 	for _, tt := range tests {