Suyu/mbedtls
1
0
Fork 0
mirror of https://git.suyu.dev/suyu/mbedtls.git synced 2025-12-24 08:16:33 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Add x509_crt_check_extended_key_usage()

Browse source
This commit is contained in:
Manuel Pégourié-Gonnard 2014-04-10 17:53:56 +02:00
parent d6ad8e949b
commit 7afb8a0dca
10 changed files with 168 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

13
include/polarssl/config.h
View file

@ -971,6 +971,19 @@
*/
#define POLARSSL_X509_CHECK_KEY_USAGE
/**
* \def POLARSSL_X509_CHECK_EXTENDED_KEY_USAGE
*
* Enable verification of the extendedKeyUsage extension (leaf certificates).
*
* Disabling this avoids problems with mis-issued and/or misused certificates.
*
* \warning Depending on your PKI use, disabling this can be a security risk!
*
* Comment to skip extendedKeyUsage checking for certificates.
*/
#define POLARSSL_X509_CHECK_EXTENDED_KEY_USAGE
/**
* \def POLARSSL_ZLIB_SUPPORT
*

18
include/polarssl/x509_crt.h
View file

@ -264,6 +264,24 @@ int x509_crt_verify( x509_crt *crt,
int x509_crt_check_key_usage( const x509_crt *crt, int usage );
#endif /* POLARSSL_X509_CHECK_KEY_USAGE) */
#if defined(POLARSSL_X509_CHECK_EXTENDED_KEY_USAGE)
/**
* \brief Check usage of certificate against extentedJeyUsage.
*
* \param crt Leaf certificate used.
* \param usage_oid Intended usage (eg OID_SERVER_AUTH or OID_CLIENT_AUTH).
* \param usage_len Length of usage_oid (eg given by OID_SIZE()).
*
* \return 0 is this use of the certificate is allowed,
* POLARSSL_ERR_X509_BAD_INPUT_DATA if not.
*
* \note Usually only makes sense on leaf certificates.
*/
int x509_crt_check_extended_key_usage( const x509_crt *crt,
const char *usage_oid,
size_t usage_len );
#endif /* POLARSSL_X509_CHECK_EXTENDED_KEY_USAGE) */
#if defined(POLARSSL_X509_CRL_PARSE_C)
/**
* \brief Verify the certificate revocation status