ARMmbed/mbedtls
1
0
Fork 0
mirror of https://github.com/ARMmbed/mbedtls.git synced 2025-05-09 00:21:18 +08:00
Code Issues Releases Wiki Activity

Clean up mbedtls_ssl_check_cert_usage()

Browse Source 
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
This commit is contained in:
Manuel Pégourié-Gonnard 2024-08-09 11:26:25 +02:00
parent 2ffa53aa28
commit 94f70228e9
3 changed files with 13 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
library/ssl_misc.h
View File

@ -1674,18 +1674,18 @@ static inline mbedtls_x509_crt *mbedtls_ssl_own_cert(mbedtls_ssl_context *ssl)
} }
/* /*
* Check usage of a certificate wrt extensions: * Check usage of a certificate wrt usage extensions:
* keyUsage, extendedKeyUsage (later), and nSCertType (later). * keyUsage and extendedKeyUsage.
* (Note: nSCertType is deprecated and not standard, we don't check it.)
* *
* Warning: cert_endpoint is the endpoint of the cert (ie, of our peer when we * Note: recv_endpoint is the receiver's endpoint.
* check a cert we received from them)!
* *
* Return 0 if everything is OK, -1 if not. * Return 0 if everything is OK, -1 if not.
*/ */
MBEDTLS_CHECK_RETURN_CRITICAL MBEDTLS_CHECK_RETURN_CRITICAL
int mbedtls_ssl_check_cert_usage(const mbedtls_x509_crt *cert, int mbedtls_ssl_check_cert_usage(const mbedtls_x509_crt *cert,
const mbedtls_ssl_ciphersuite_t *ciphersuite, const mbedtls_ssl_ciphersuite_t *ciphersuite,
int cert_endpoint, int recv_endpoint,
uint32_t *flags); uint32_t *flags);
#endif /* MBEDTLS_X509_CRT_PARSE_C */ #endif /* MBEDTLS_X509_CRT_PARSE_C */

11
library/ssl_tls.c
View File

@ -6361,7 +6361,7 @@ const char *mbedtls_ssl_get_curve_name_from_tls_id(uint16_t tls_id)
#if defined(MBEDTLS_X509_CRT_PARSE_C) #if defined(MBEDTLS_X509_CRT_PARSE_C)
int mbedtls_ssl_check_cert_usage(const mbedtls_x509_crt *cert, int mbedtls_ssl_check_cert_usage(const mbedtls_x509_crt *cert,
const mbedtls_ssl_ciphersuite_t *ciphersuite, const mbedtls_ssl_ciphersuite_t *ciphersuite,
int cert_endpoint, int recv_endpoint,
uint32_t *flags) uint32_t *flags)
{ {
int ret = 0; int ret = 0;
@ -6369,7 +6369,10 @@ int mbedtls_ssl_check_cert_usage(const mbedtls_x509_crt *cert,
const char *ext_oid; const char *ext_oid;
size_t ext_len; size_t ext_len;
if (cert_endpoint == MBEDTLS_SSL_IS_SERVER) { /* Note: don't guard this with MBEDTLS_SSL_CLI_C because the server wants
* to check what a compliant client will think while choosing which cert
* to send to the client. */
if (recv_endpoint == MBEDTLS_SSL_IS_CLIENT) {
/* Server part of the key exchange */ /* Server part of the key exchange */
switch (ciphersuite->key_exchange) { switch (ciphersuite->key_exchange) {
case MBEDTLS_KEY_EXCHANGE_RSA: case MBEDTLS_KEY_EXCHANGE_RSA:
@ -6406,7 +6409,7 @@ int mbedtls_ssl_check_cert_usage(const mbedtls_x509_crt *cert,
ret = -1; ret = -1;
} }
if (cert_endpoint == MBEDTLS_SSL_IS_SERVER) { if (recv_endpoint == MBEDTLS_SSL_IS_CLIENT) {
ext_oid = MBEDTLS_OID_SERVER_AUTH; ext_oid = MBEDTLS_OID_SERVER_AUTH;
ext_len = MBEDTLS_OID_SIZE(MBEDTLS_OID_SERVER_AUTH); ext_len = MBEDTLS_OID_SIZE(MBEDTLS_OID_SERVER_AUTH);
} else { } else {
@ -8061,7 +8064,7 @@ static int ssl_parse_certificate_verify(mbedtls_ssl_context *ssl,
if (mbedtls_ssl_check_cert_usage(chain, if (mbedtls_ssl_check_cert_usage(chain,
ciphersuite_info, ciphersuite_info,
!ssl->conf->endpoint, ssl->conf->endpoint,
&ssl->session_negotiate->verify_result) != 0) { &ssl->session_negotiate->verify_result) != 0) {
MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate (usage extensions)")); MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate (usage extensions)"));
if (ret == 0) { if (ret == 0) {

2
library/ssl_tls12_server.c
View File

@ -756,7 +756,7 @@ static int ssl_pick_cert(mbedtls_ssl_context *ssl,
* and decrypting with the same RSA key. * and decrypting with the same RSA key.
*/ */
if (mbedtls_ssl_check_cert_usage(cur->cert, ciphersuite_info, if (mbedtls_ssl_check_cert_usage(cur->cert, ciphersuite_info,
MBEDTLS_SSL_IS_SERVER, &flags) != 0) { MBEDTLS_SSL_IS_CLIENT, &flags) != 0) {
MBEDTLS_SSL_DEBUG_MSG(3, ("certificate mismatch: " MBEDTLS_SSL_DEBUG_MSG(3, ("certificate mismatch: "
"(extended) key usage extension")); "(extended) key usage extension"));
continue; continue;