From d08de432b634cc26c6ca8839573d7dddab7ae574 Mon Sep 17 00:00:00 2001
From: Hannes Mehnert <hannes@mehnert.org>
Date: Sun, 28 Oct 2018 22:28:22 +0100
Subject: [PATCH] use proper extension

---
 app/vmmp_ca.ml | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/app/vmmp_ca.ml b/app/vmmp_ca.ml
index 9e3d65d..f4e9de8 100644
--- a/app/vmmp_ca.ml
+++ b/app/vmmp_ca.ml
@@ -39,8 +39,7 @@ let sign dbname cacert key csr days =
   Logs.app (fun m -> m "signing certificate with subject %s"
                (X509.distinguished_name_to_string ri.X509.CA.subject)) ;
   let issuer = X509.subject cacert in
-  (* TODO: handle version mismatch of the delegation cert specially here *)
-  (* TODO: check delegation! *)
+  (* TODO: check delegation! verify whitelisted commands!? *)
   match albatross_extension csr with
   | Ok (ext, v) ->
     Vmm_asn.cert_extension_of_cstruct v >>= fun (version, cmd) ->
@@ -48,9 +47,12 @@ let sign dbname cacert key csr days =
        Ok ()
      else
        Error (`Msg "unknown version in request")) >>= fun () ->
-    (* TODO l_exts / d_exts trouble *)
+    let exts = match cmd with
+      | `Policy_cmd (`Policy_add _) -> d_exts ()
+      | _ -> l_exts
+    in
     Logs.app (fun m -> m "signing %a" Vmm_commands.pp cmd) ;
-    Ok (ext :: l_exts) >>= fun extensions ->
+    Ok (ext :: exts) >>= fun extensions ->
     Vmm_provision.sign ~dbname extensions issuer key csr (Duration.of_day days)
   | Error e -> Error e