Suyu/mbedtls
1
0
Fork 0
mirror of https://git.suyu.dev/suyu/mbedtls.git synced 2025-12-21 21:36:21 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

manually merge 0c6ce2f use x509_crt_verify_info()

Browse source
This commit is contained in:
Manuel Pégourié-Gonnard 2015-04-20 10:56:18 +01:00
parent b5f48ad82f
commit 89addc43db
7 changed files with 55 additions and 132 deletions
Download patch file Download diff file Expand all files Collapse all files

18
programs/ssl/ssl_client1.c
View file

@ -187,24 +187,16 @@ int main( void )
*/
mbedtls_printf( " . Verifying peer X.509 certificate..." );
/* In real life, we may want to bail out when ret != 0 */
/* In real life, we probably want to bail out when ret != 0 */
if( ( ret = mbedtls_ssl_get_verify_result( &ssl ) ) != 0 )
{
char vrfy_buf[512];
mbedtls_printf( " failed\n" );
if( ( ret & MBEDTLS_BADCERT_EXPIRED ) != 0 )
mbedtls_printf( " ! server certificate has expired\n" );
mbedtls_x509_crt_verify_info( vrfy_buf, sizeof( vrfy_buf ), " ! ", ret );
if( ( ret & MBEDTLS_X509_BADCERT_REVOKED ) != 0 )
mbedtls_printf( " ! server certificate has been revoked\n" );
if( ( ret & MBEDTLS_X509_BADCERT_CN_MISMATCH ) != 0 )
mbedtls_printf( " ! CN mismatch (expected CN=%s)\n", "PolarSSL Server 1" );
if( ( ret & MBEDTLS_X509_BADCERT_NOT_TRUSTED ) != 0 )
mbedtls_printf( " ! self-signed or not signed by a trusted CA\n" );
mbedtls_printf( "\n" );
mbedtls_printf( "%s\n", vrfy_buf );
}
else
mbedtls_printf( " ok\n" );

42
programs/ssl/ssl_client2.c
View file

@ -373,29 +373,13 @@ static int my_verify( void *data, mbedtls_x509_crt *crt, int depth, int *flags )
mbedtls_x509_crt_info( buf, sizeof( buf ) - 1, "", crt );
mbedtls_printf( "%s", buf );
if( ( (*flags) & MBEDTLS_BADCERT_EXPIRED ) != 0 )
mbedtls_printf( " ! server certificate has expired\n" );
if( ( (*flags) & MBEDTLS_X509_BADCERT_REVOKED ) != 0 )
mbedtls_printf( " ! server certificate has been revoked\n" );
if( ( (*flags) & MBEDTLS_X509_BADCERT_CN_MISMATCH ) != 0 )
mbedtls_printf( " ! CN mismatch\n" );
if( ( (*flags) & MBEDTLS_X509_BADCERT_NOT_TRUSTED ) != 0 )
mbedtls_printf( " ! self-signed or not signed by a trusted CA\n" );
if( ( (*flags) & MBEDTLS_X509_BADCRL_NOT_TRUSTED ) != 0 )
mbedtls_printf( " ! CRL not trusted\n" );
if( ( (*flags) & MBEDTLS_X509_BADCRL_EXPIRED ) != 0 )
mbedtls_printf( " ! CRL expired\n" );
if( ( (*flags) & MBEDTLS_BADCERT_OTHER ) != 0 )
mbedtls_printf( " ! other (unknown) flag\n" );
if ( ( *flags ) == 0 )
mbedtls_printf( " This certificate has no flags\n" );
else
{
mbedtls_x509_crt_verify_info( buf, sizeof( buf ), " ! ", *flags );
mbedtls_printf( "%s\n", buf );
}
return( 0 );
}
@ -1287,21 +1271,13 @@ int main( int argc, char *argv[] )
if( ( ret = mbedtls_ssl_get_verify_result( &ssl ) ) != 0 )
{
char vrfy_buf[512];
mbedtls_printf( " failed\n" );
if( ( ret & MBEDTLS_BADCERT_EXPIRED ) != 0 )
mbedtls_printf( " ! server certificate has expired\n" );
mbedtls_x509_crt_verify_info( vrfy_buf, sizeof( vrfy_buf ), " ! ", ret );
if( ( ret & MBEDTLS_X509_BADCERT_REVOKED ) != 0 )
mbedtls_printf( " ! server certificate has been revoked\n" );
if( ( ret & MBEDTLS_X509_BADCERT_CN_MISMATCH ) != 0 )
mbedtls_printf( " ! CN mismatch (expected CN=%s)\n", opt.server_name );
if( ( ret & MBEDTLS_X509_BADCERT_NOT_TRUSTED ) != 0 )
mbedtls_printf( " ! self-signed or not signed by a trusted CA\n" );
mbedtls_printf( "\n" );
mbedtls_printf( "%s\n", vrfy_buf );
}
else
mbedtls_printf( " ok\n" );

24
programs/ssl/ssl_mail_client.c
View file

@ -163,7 +163,7 @@ static void my_debug( void *ctx, int level, const char *str )
}
}
static int do_handshake( mbedtls_ssl_context *ssl, struct options *opt )
static int do_handshake( mbedtls_ssl_context *ssl )
{
int ret;
unsigned char buf[1024];
@ -195,24 +195,16 @@ static int do_handshake( mbedtls_ssl_context *ssl, struct options *opt )
*/
mbedtls_printf( " . Verifying peer X.509 certificate..." );
/* In real life, we may want to bail out when ret != 0 */
/* In real life, we probably want to bail out when ret != 0 */
if( ( ret = mbedtls_ssl_get_verify_result( ssl ) ) != 0 )
{
char vrfy_buf[512];
mbedtls_printf( " failed\n" );
if( ( ret & MBEDTLS_BADCERT_EXPIRED ) != 0 )
mbedtls_printf( " ! server certificate has expired\n" );
mbedtls_x509_crt_verify_info( vrfy_buf, sizeof( vrfy_buf ), " ! ", ret );
if( ( ret & MBEDTLS_X509_BADCERT_REVOKED ) != 0 )
mbedtls_printf( " ! server certificate has been revoked\n" );
if( ( ret & MBEDTLS_X509_BADCERT_CN_MISMATCH ) != 0 )
mbedtls_printf( " ! CN mismatch (expected CN=%s)\n", opt->server_name );
if( ( ret & MBEDTLS_X509_BADCERT_NOT_TRUSTED ) != 0 )
mbedtls_printf( " ! self-signed or not signed by a trusted CA\n" );
mbedtls_printf( "\n" );
mbedtls_printf( "%s\n", vrfy_buf );
}
else
mbedtls_printf( " ok\n" );
@ -626,7 +618,7 @@ int main( int argc, char *argv[] )
if( opt.mode == MODE_SSL_TLS )
{
if( do_handshake( &ssl, &opt ) != 0 )
if( do_handshake( &ssl ) != 0 )
goto exit;
mbedtls_printf( " > Get header from server:" );
@ -695,7 +687,7 @@ int main( int argc, char *argv[] )
mbedtls_printf(" ok\n" );
if( do_handshake( &ssl, &opt ) != 0 )
if( do_handshake( &ssl ) != 0 )
goto exit;
}

16
programs/ssl/ssl_server2.c
View file

@ -1910,21 +1910,13 @@ reset:
if( ( ret = mbedtls_ssl_get_verify_result( &ssl ) ) != 0 )
{
char vrfy_buf[512];
mbedtls_printf( " failed\n" );
if( !mbedtls_ssl_get_peer_cert( &ssl ) )
mbedtls_printf( " ! no client certificate sent\n" );
mbedtls_x509_crt_verify_info( vrfy_buf, sizeof( vrfy_buf ), " ! ", ret );
if( ( ret & MBEDTLS_BADCERT_EXPIRED ) != 0 )
mbedtls_printf( " ! client certificate has expired\n" );
if( ( ret & MBEDTLS_X509_BADCERT_REVOKED ) != 0 )
mbedtls_printf( " ! client certificate has been revoked\n" );
if( ( ret & MBEDTLS_X509_BADCERT_NOT_TRUSTED ) != 0 )
mbedtls_printf( " ! self-signed or not signed by a trusted CA\n" );
mbedtls_printf( "\n" );
mbedtls_printf( "%s\n", vrfy_buf );
}
else
mbedtls_printf( " ok\n" );