Suyu/mbedtls
1
0
Fork 0
mirror of https://git.suyu.dev/suyu/mbedtls.git synced 2025-12-24 00:06:32 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Add ssl_set_hs_ca_chain()

Browse source
This commit is contained in:
Manuel Pégourié-Gonnard 2015-05-11 08:46:37 +02:00
parent 1897af9e93
commit 22bfa4bb53
3 changed files with 58 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

4
library/ssl_srv.c
View file

@ -2725,7 +2725,9 @@ static int ssl_write_certificate_request( mbedtls_ssl_context *ssl )
* opaque DistinguishedName<1..2^16-1>;
*/
p += 2;
crt = ssl->conf->ca_chain;
crt = ssl->handshake->sni_ca_chain != NULL ?
ssl->handshake->sni_ca_chain :
ssl->conf->ca_chain;
total_dn_size = 0;
while( crt != NULL && crt->version != 0 )

26
library/ssl_tls.c
View file

@ -4029,7 +4029,21 @@ int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl )
if( ssl->conf->authmode != MBEDTLS_SSL_VERIFY_NONE )
{
if( ssl->conf->ca_chain == NULL )
mbedtls_x509_crt *ca_chain;
mbedtls_x509_crl *ca_crl;
if( ssl->handshake->sni_ca_chain != NULL )
{
ca_chain = ssl->handshake->sni_ca_chain;
ca_crl = ssl->handshake->sni_ca_crl;
}
else
{
ca_chain = ssl->conf->ca_chain;
ca_crl = ssl->conf->ca_crl;
}
if( ca_chain == NULL )
{
MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no CA chain" ) );
return( MBEDTLS_ERR_SSL_CA_CHAIN_REQUIRED );
@ -4039,7 +4053,7 @@ int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl )
* Main check: verify certificate
*/
ret = mbedtls_x509_crt_verify( ssl->session_negotiate->peer_cert,
ssl->conf->ca_chain, ssl->conf->ca_crl, ssl->hostname,
ca_chain, ca_crl, ssl->hostname,
&ssl->session_negotiate->verify_result,
ssl->conf->f_vrfy, ssl->conf->p_vrfy );
@ -5360,6 +5374,14 @@ int mbedtls_ssl_set_hs_own_cert( mbedtls_ssl_context *ssl,
return( ssl_append_key_cert( &ssl->handshake->sni_key_cert,
own_cert, pk_key ) );
}
void mbedtls_ssl_set_hs_ca_chain( mbedtls_ssl_context *ssl,
mbedtls_x509_crt *ca_chain,
mbedtls_x509_crl *ca_crl )
{
ssl->handshake->sni_ca_chain = ca_chain;
ssl->handshake->sni_ca_crl = ca_crl;
}
#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)