Suyu/mbedtls
1
0
Fork 0
mirror of https://git.suyu.dev/suyu/mbedtls.git synced 2026-01-08 15:39:22 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix implementation of VERIFY_OPTIONAL verification mode

Browse source 
This commit changes the behaviour of mbedtls_ssl_parse_certificate
to make the two authentication modes MBEDTLS_SSL_VERIFY_REQUIRED and
MBEDTLS_SSL_VERIFY_OPTIONAL be in the following relationship:

    Mode == MBEDTLS_SSL_VERIFY_REQUIRED
<=> Mode == MBEDTLS_SSL_VERIFY_OPTIONAL + check verify result

Also, it changes the behaviour to perform the certificate chain
verification even if the trusted CA chain is empty. Previously, the
function failed in this case, even when using optional verification,
which was brought up in #864.
This commit is contained in:
Hanno Becker 2017-05-08 16:31:14 +01:00
parent ddc6e52cc1
commit 39ae8cd207
2 changed files with 29 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

7
ChangeLog
View file

@ -17,6 +17,13 @@ Bugfix
that triggered the alert.
* In SSLv3, if refusing a renegotiation attempt, don't process any further
data.
* Accept empty trusted CA chain in authentication mode
MBEDTLS_SSL_VERIFY_OPTIONAL.
Fixes #864. Found by jethrogb.
* Fix implementation of mbedtls_ssl_parse_certificate
to not annihilate fatal errors in authentication mode
MBEDTLS_SSL_VERIFY_OPTIONAL and to reflect bad EC curves
within verification result.
Changes
* Send fatal alerts in many more cases instead of dropping the connection.