Suyu/mbedtls
1
0
Fork 0
mirror of https://git.suyu.dev/suyu/mbedtls.git synced 2026-01-06 22:49:34 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Add x509_crt_verify_info()

Browse source
This commit is contained in:
Manuel Pégourié-Gonnard 2015-04-17 16:14:32 +02:00
parent 23c0608e28
commit 39a183a629
6 changed files with 115 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

8
include/polarssl/x509.h
View file

@ -82,17 +82,21 @@
* \name X509 Verify codes
* \{
*/
/* Reminder: update x509_crt_verify_strings[] in library/x509_crt.c */
#define BADCERT_EXPIRED 0x01 /**< The certificate validity has expired. */
#define BADCERT_REVOKED 0x02 /**< The certificate has been revoked (is on a CRL). */
#define BADCERT_CN_MISMATCH 0x04 /**< The certificate Common Name (CN) does not match with the expected CN. */
#define BADCERT_NOT_TRUSTED 0x08 /**< The certificate is not correctly signed by the trusted CA. */
#define BADCRL_NOT_TRUSTED 0x10 /**< CRL is not correctly signed by the trusted CA. */
#define BADCRL_EXPIRED 0x20 /**< CRL is expired. */
#define BADCRL_NOT_TRUSTED 0x10 /**< The CRL is not correctly signed by the trusted CA. */
#define BADCRL_EXPIRED 0x20 /**< The CRL is expired. */
#define BADCERT_MISSING 0x40 /**< Certificate was missing. */
#define BADCERT_SKIP_VERIFY 0x80 /**< Certificate verification was skipped. */
#define BADCERT_OTHER 0x0100 /**< Other reason (can be used by verify callback) */
#define BADCERT_FUTURE 0x0200 /**< The certificate validity starts in the future. */
#define BADCRL_FUTURE 0x0400 /**< The CRL is from the future */
#define BADCERT_KEY_USAGE 0x0800 /**< Usage does not match the keyUsage extension. */
#define BADCERT_EXT_KEY_USAGE 0x1000 /**< Usage does not match the extendedKeyUsage extension. */
#define BADCERT_NS_CERT_TYPE 0x2000 /**< Usage does not match the nsCertType extension. */
/* \} name */
/* \} addtogroup x509_module */

26
include/polarssl/x509_crt.h
View file

@ -202,6 +202,21 @@ int x509_crt_parse_path( x509_crt *chain, const char *path );
int x509_crt_info( char *buf, size_t size, const char *prefix,
const x509_crt *crt );
/**
* \brief Returns an informational string about the
* verification status of a certificate.
*
* \param buf Buffer to write to
* \param size Maximum size of buffer
* \param prefix A line prefix
* \param flags Verification flags created by x509_crt_verify()
*
* \return The amount of data written to the buffer, or -1 in
* case of an error.
*/
int x509_crt_verify_info( char *buf, size_t size, const char *prefix,
int flags );
/**
* \brief Verify the certificate signature
*
@ -219,6 +234,9 @@ int x509_crt_info( char *buf, size_t size, const char *prefix,
* are also returned to the application. The function should
* return 0 for anything but a fatal error.
*
* \note In case verification failed, the results can be displayed
* using \c x509_crt_verify_info()
*
* \param crt a certificate to be verified
* \param trust_ca the trusted CA chain
* \param ca_crl the CRL chain for trusted CA's
@ -229,12 +247,8 @@ int x509_crt_info( char *buf, size_t size, const char *prefix,
* \param p_vrfy verification parameter
*
* \return 0 if successful or POLARSSL_ERR_X509_SIG_VERIFY_FAILED,
* in which case *flags will have one or more of
* the following values set:
* BADCERT_EXPIRED --
* BADCERT_REVOKED --
* BADCERT_CN_MISMATCH --
* BADCERT_NOT_TRUSTED
* in which case *flags will have one or more BADCERT_XXX or
* BADCRL_XXX flags set,
* or another error in case of a fatal error encountered
* during the verification process.
*/