Suyu/mbedtls
1
0
Fork 0
mirror of https://git.suyu.dev/suyu/mbedtls.git synced 2025-12-21 21:36:21 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Check keyUsage in SSL client and server

Browse source
This commit is contained in:
Manuel Pégourié-Gonnard 2014-04-09 09:50:57 +02:00 • committed by Paul Bakker
parent 603116c570
commit 7f2a07d7b2
11 changed files with 347 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

14
library/ssl_srv.c
View file

@ -797,6 +797,20 @@ static int ssl_pick_cert( ssl_context *ssl,
if( ! pk_can_do( cur->key, pk_alg ) )
continue;
/*
* This avoids sending the client a cert it'll reject based on
* keyUsage or other extensions.
*
* It also allows the user to provision different certificates for
* different uses based on keyUsage, eg if they want to avoid signing
* and decrypting with the same RSA key.
*/
if( ssl_check_cert_usage( cur->cert, ciphersuite_info,
SSL_IS_SERVER ) != 0 )
{
continue;
}
#if defined(POLARSSL_ECDSA_C)
if( pk_alg == POLARSSL_PK_ECDSA )
{