mirror/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2025-02-11 18:40:53 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

tls13: Fix certificate key usage checks

Browse Source 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
This commit is contained in:
Ronald Cron 2022-06-16 19:31:06 +02:00
parent d28f5a98f1
commit 30c5a2520e
1 changed files with 20 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
library/ssl_tls13_generic.c
View File

@ -542,6 +542,8 @@ static int ssl_tls13_validate_certificate( mbedtls_ssl_context *ssl )
int authmode = MBEDTLS_SSL_VERIFY_REQUIRED; int authmode = MBEDTLS_SSL_VERIFY_REQUIRED;
mbedtls_x509_crt *ca_chain; mbedtls_x509_crt *ca_chain;
mbedtls_x509_crl *ca_crl; mbedtls_x509_crl *ca_crl;
const char *ext_oid;
size_t ext_len;
uint32_t verify_result = 0; uint32_t verify_result = 0;
/* If SNI was used, overwrite authentication mode /* If SNI was used, overwrite authentication mode
@ -623,12 +625,25 @@ static int ssl_tls13_validate_certificate( mbedtls_ssl_context *ssl )
/* /*
* Secondary checks: always done, but change 'ret' only if it was 0 * Secondary checks: always done, but change 'ret' only if it was 0
*/ */
if( mbedtls_ssl_check_cert_usage( ssl->session_negotiate->peer_cert, if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
ssl->handshake->ciphersuite_info,
!ssl->conf->endpoint,
&verify_result ) != 0 )
{ {
MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate ( usage extensions )" ) ); ext_oid = MBEDTLS_OID_SERVER_AUTH;
ext_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_SERVER_AUTH );
}
else
{
ext_oid = MBEDTLS_OID_CLIENT_AUTH;
ext_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_CLIENT_AUTH );
}
if( ( mbedtls_x509_crt_check_key_usage(
ssl->session_negotiate->peer_cert,
MBEDTLS_X509_KU_DIGITAL_SIGNATURE ) != 0 ) ||
( mbedtls_x509_crt_check_extended_key_usage(
ssl->session_negotiate->peer_cert,
ext_oid, ext_len ) != 0 ) )
{
MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate (usage extensions)" ) );
if( ret == 0 ) if( ret == 0 )
ret = MBEDTLS_ERR_SSL_BAD_CERTIFICATE; ret = MBEDTLS_ERR_SSL_BAD_CERTIFICATE;
} }