summaryrefslogtreecommitdiff
path: root/src/openvpn/ssl_verify_mbedtls.c
diff options
context:
space:
mode:
authorAlberto Gonzalez Iniesta <agi@inittab.org>2016-12-27 18:25:47 +0100
committerAlberto Gonzalez Iniesta <agi@inittab.org>2016-12-27 18:25:47 +0100
commit79f3537f69e125f19f59c36aa090120a63186a54 (patch)
tree2089a3b7dac990841dbc2e4d9b2f535b82dbb0af /src/openvpn/ssl_verify_mbedtls.c
parentf2137fedb30cb87448eb03b2f288920df6187571 (diff)
parent3a2bbdb05ca6a6996e424c9fb225cb0d53804125 (diff)
Merge tag 'upstream/2.4.0'
Upstream version 2.4.0
Diffstat (limited to 'src/openvpn/ssl_verify_mbedtls.c')
-rw-r--r--src/openvpn/ssl_verify_mbedtls.c643
1 files changed, 334 insertions, 309 deletions
diff --git a/src/openvpn/ssl_verify_mbedtls.c b/src/openvpn/ssl_verify_mbedtls.c
index 4260823..f01569f 100644
--- a/src/openvpn/ssl_verify_mbedtls.c
+++ b/src/openvpn/ssl_verify_mbedtls.c
@@ -5,8 +5,8 @@
* packet encryption, packet authentication, and
* packet compression.
*
- * Copyright (C) 2002-2010 OpenVPN Technologies, Inc. <sales@openvpn.net>
- * Copyright (C) 2010 Fox Crypto B.V. <openvpn@fox-it.com>
+ * Copyright (C) 2002-2017 OpenVPN Technologies, Inc. <sales@openvpn.net>
+ * Copyright (C) 2010-2017 Fox Crypto B.V. <openvpn@fox-it.com>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2
@@ -48,293 +48,305 @@
#define MAX_SUBJECT_LENGTH 256
int
-verify_callback (void *session_obj, mbedtls_x509_crt *cert, int cert_depth,
- uint32_t *flags)
+verify_callback(void *session_obj, mbedtls_x509_crt *cert, int cert_depth,
+ uint32_t *flags)
{
- struct tls_session *session = (struct tls_session *) session_obj;
- struct gc_arena gc = gc_new();
+ struct tls_session *session = (struct tls_session *) session_obj;
+ struct gc_arena gc = gc_new();
- ASSERT (cert);
- ASSERT (session);
+ ASSERT(cert);
+ ASSERT(session);
- session->verified = false;
+ session->verified = false;
- /* Remember certificate hash */
- struct buffer cert_fingerprint = x509_get_sha256_fingerprint (cert, &gc);
- cert_hash_remember (session, cert_depth, &cert_fingerprint);
+ /* Remember certificate hash */
+ struct buffer cert_fingerprint = x509_get_sha256_fingerprint(cert, &gc);
+ cert_hash_remember(session, cert_depth, &cert_fingerprint);
- /* did peer present cert which was signed by our root cert? */
- if (*flags != 0)
+ /* did peer present cert which was signed by our root cert? */
+ if (*flags != 0)
{
- int ret = 0;
- char errstr[512] = { 0 };
- char *subject = x509_get_subject(cert, &gc);
-
- ret = mbedtls_x509_crt_verify_info (errstr, sizeof(errstr)-1, "", *flags);
- if (ret <= 0 && !openvpn_snprintf(errstr, sizeof(errstr),
- "Could not retrieve error string, flags=%"PRIx32, *flags))
- {
- errstr[0] = '\0';
- }
- else
- {
- chomp(errstr);
- }
-
- if (subject)
- {
- msg (D_TLS_ERRORS, "VERIFY ERROR: depth=%d, subject=%s: %s",
- cert_depth, subject, errstr);
- }
- else
- {
- msg (D_TLS_ERRORS, "VERIFY ERROR: depth=%d, (could not extract X509 "
- "subject string from certificate): %s", cert_depth, errstr);
- }
-
- /* Leave flags set to non-zero to indicate that the cert is not ok */
+ int ret = 0;
+ char errstr[512] = { 0 };
+ char *subject = x509_get_subject(cert, &gc);
+
+ ret = mbedtls_x509_crt_verify_info(errstr, sizeof(errstr)-1, "", *flags);
+ if (ret <= 0 && !openvpn_snprintf(errstr, sizeof(errstr),
+ "Could not retrieve error string, flags=%" PRIx32, *flags))
+ {
+ errstr[0] = '\0';
+ }
+ else
+ {
+ chomp(errstr);
+ }
+
+ if (subject)
+ {
+ msg(D_TLS_ERRORS, "VERIFY ERROR: depth=%d, subject=%s: %s",
+ cert_depth, subject, errstr);
+ }
+ else
+ {
+ msg(D_TLS_ERRORS, "VERIFY ERROR: depth=%d, (could not extract X509 "
+ "subject string from certificate): %s", cert_depth, errstr);
+ }
+
+ /* Leave flags set to non-zero to indicate that the cert is not ok */
}
- else if (SUCCESS != verify_cert(session, cert, cert_depth))
+ else if (SUCCESS != verify_cert(session, cert, cert_depth))
{
- *flags |= MBEDTLS_X509_BADCERT_OTHER;
+ *flags |= MBEDTLS_X509_BADCERT_OTHER;
}
- gc_free(&gc);
+ gc_free(&gc);
- /*
- * PolarSSL/mbed TLS-1.2.0+ expects 0 on anything except fatal errors.
- */
- return 0;
+ /*
+ * PolarSSL/mbed TLS-1.2.0+ expects 0 on anything except fatal errors.
+ */
+ return 0;
}
#ifdef ENABLE_X509ALTUSERNAME
-# warning "X509 alt user name not yet supported for mbed TLS"
+#warning "X509 alt user name not yet supported for mbed TLS"
#endif
result_t
-backend_x509_get_username (char *cn, int cn_len,
- char *x509_username_field, mbedtls_x509_crt *cert)
+backend_x509_get_username(char *cn, int cn_len,
+ char *x509_username_field, mbedtls_x509_crt *cert)
{
- mbedtls_x509_name *name;
+ mbedtls_x509_name *name;
- ASSERT( cn != NULL );
+ ASSERT( cn != NULL );
- name = &cert->subject;
+ name = &cert->subject;
- /* Find common name */
- while( name != NULL )
- {
- if (0 == memcmp (name->oid.p, MBEDTLS_OID_AT_CN,
- MBEDTLS_OID_SIZE (MBEDTLS_OID_AT_CN)))
- break;
+ /* Find common name */
+ while (name != NULL)
+ {
+ if (0 == memcmp(name->oid.p, MBEDTLS_OID_AT_CN,
+ MBEDTLS_OID_SIZE(MBEDTLS_OID_AT_CN)))
+ {
+ break;
+ }
- name = name->next;
- }
+ name = name->next;
+ }
- /* Not found, return an error if this is the peer's certificate */
- if( name == NULL )
- return FAILURE;
+ /* Not found, return an error if this is the peer's certificate */
+ if (name == NULL)
+ {
+ return FAILURE;
+ }
- /* Found, extract CN */
- if (cn_len > name->val.len)
+ /* Found, extract CN */
+ if (cn_len > name->val.len)
{
- memcpy( cn, name->val.p, name->val.len );
- cn[name->val.len] = '\0';
+ memcpy( cn, name->val.p, name->val.len );
+ cn[name->val.len] = '\0';
}
- else
+ else
{
- memcpy( cn, name->val.p, cn_len);
- cn[cn_len-1] = '\0';
+ memcpy( cn, name->val.p, cn_len);
+ cn[cn_len-1] = '\0';
}
- return SUCCESS;
+ return SUCCESS;
}
char *
-backend_x509_get_serial (mbedtls_x509_crt *cert, struct gc_arena *gc)
+backend_x509_get_serial(mbedtls_x509_crt *cert, struct gc_arena *gc)
{
- char *buf = NULL;
- size_t buflen = 0;
- mbedtls_mpi serial_mpi = { 0 };
-
- /* Transform asn1 integer serial into mbed TLS MPI */
- mbedtls_mpi_init(&serial_mpi);
- if (!mbed_ok(mbedtls_mpi_read_binary(&serial_mpi, cert->serial.p,
- cert->serial.len)))
+ char *buf = NULL;
+ size_t buflen = 0;
+ mbedtls_mpi serial_mpi = { 0 };
+
+ /* Transform asn1 integer serial into mbed TLS MPI */
+ mbedtls_mpi_init(&serial_mpi);
+ if (!mbed_ok(mbedtls_mpi_read_binary(&serial_mpi, cert->serial.p,
+ cert->serial.len)))
{
- msg(M_WARN, "Failed to retrieve serial from certificate.");
- goto end;
+ msg(M_WARN, "Failed to retrieve serial from certificate.");
+ goto end;
}
- /* Determine decimal representation length, allocate buffer */
- mbedtls_mpi_write_string(&serial_mpi, 10, NULL, 0, &buflen);
- buf = gc_malloc(buflen, true, gc);
+ /* Determine decimal representation length, allocate buffer */
+ mbedtls_mpi_write_string(&serial_mpi, 10, NULL, 0, &buflen);
+ buf = gc_malloc(buflen, true, gc);
- /* Write MPI serial as decimal string into buffer */
- if (!mbed_ok(mbedtls_mpi_write_string(&serial_mpi, 10, buf, buflen, &buflen)))
+ /* Write MPI serial as decimal string into buffer */
+ if (!mbed_ok(mbedtls_mpi_write_string(&serial_mpi, 10, buf, buflen, &buflen)))
{
- msg(M_WARN, "Failed to write serial to string.");
- buf = NULL;
- goto end;
+ msg(M_WARN, "Failed to write serial to string.");
+ buf = NULL;
+ goto end;
}
end:
- mbedtls_mpi_free(&serial_mpi);
- return buf;
+ mbedtls_mpi_free(&serial_mpi);
+ return buf;
}
char *
-backend_x509_get_serial_hex (mbedtls_x509_crt *cert, struct gc_arena *gc)
+backend_x509_get_serial_hex(mbedtls_x509_crt *cert, struct gc_arena *gc)
{
- char *buf = NULL;
- size_t len = cert->serial.len * 3 + 1;
+ char *buf = NULL;
+ size_t len = cert->serial.len * 3 + 1;
- buf = gc_malloc(len, true, gc);
+ buf = gc_malloc(len, true, gc);
- if(mbedtls_x509_serial_gets(buf, len-1, &cert->serial) < 0)
- buf = NULL;
+ if (mbedtls_x509_serial_gets(buf, len-1, &cert->serial) < 0)
+ {
+ buf = NULL;
+ }
- return buf;
+ return buf;
}
static struct buffer
-x509_get_fingerprint (const mbedtls_md_info_t *md_info, mbedtls_x509_crt *cert,
- struct gc_arena *gc)
+x509_get_fingerprint(const mbedtls_md_info_t *md_info, mbedtls_x509_crt *cert,
+ struct gc_arena *gc)
{
- const size_t md_size = mbedtls_md_get_size (md_info);
- struct buffer fingerprint = alloc_buf_gc (md_size, gc);
- mbedtls_md(md_info, cert->raw.p, cert->tbs.len, BPTR (&fingerprint));
- ASSERT (buf_inc_len(&fingerprint, md_size));
- return fingerprint;
+ const size_t md_size = mbedtls_md_get_size(md_info);
+ struct buffer fingerprint = alloc_buf_gc(md_size, gc);
+ mbedtls_md(md_info, cert->raw.p, cert->tbs.len, BPTR(&fingerprint));
+ ASSERT(buf_inc_len(&fingerprint, md_size));
+ return fingerprint;
}
struct buffer
-x509_get_sha1_fingerprint (mbedtls_x509_crt *cert, struct gc_arena *gc)
+x509_get_sha1_fingerprint(mbedtls_x509_crt *cert, struct gc_arena *gc)
{
- return x509_get_fingerprint(mbedtls_md_info_from_type(MBEDTLS_MD_SHA1),
- cert, gc);
+ return x509_get_fingerprint(mbedtls_md_info_from_type(MBEDTLS_MD_SHA1),
+ cert, gc);
}
struct buffer
-x509_get_sha256_fingerprint (mbedtls_x509_crt *cert, struct gc_arena *gc)
+x509_get_sha256_fingerprint(mbedtls_x509_crt *cert, struct gc_arena *gc)
{
- return x509_get_fingerprint(mbedtls_md_info_from_type(MBEDTLS_MD_SHA256),
- cert, gc);
+ return x509_get_fingerprint(mbedtls_md_info_from_type(MBEDTLS_MD_SHA256),
+ cert, gc);
}
char *
x509_get_subject(mbedtls_x509_crt *cert, struct gc_arena *gc)
{
- char tmp_subject[MAX_SUBJECT_LENGTH] = {0};
- char *subject = NULL;
+ char tmp_subject[MAX_SUBJECT_LENGTH] = {0};
+ char *subject = NULL;
- int ret = 0;
+ int ret = 0;
- ret = mbedtls_x509_dn_gets( tmp_subject, MAX_SUBJECT_LENGTH-1, &cert->subject );
- if (ret > 0)
+ ret = mbedtls_x509_dn_gets( tmp_subject, MAX_SUBJECT_LENGTH-1, &cert->subject );
+ if (ret > 0)
{
- /* Allocate the required space for the subject */
- subject = string_alloc(tmp_subject, gc);
+ /* Allocate the required space for the subject */
+ subject = string_alloc(tmp_subject, gc);
}
- return subject;
+ return subject;
}
static void
-do_setenv_x509 (struct env_set *es, const char *name, char *value, int depth)
+do_setenv_x509(struct env_set *es, const char *name, char *value, int depth)
{
- char *name_expand;
- size_t name_expand_size;
-
- string_mod (value, CC_ANY, CC_CRLF, '?');
- msg (D_X509_ATTR, "X509 ATTRIBUTE name='%s' value='%s' depth=%d", name, value, depth);
- name_expand_size = 64 + strlen (name);
- name_expand = (char *) malloc (name_expand_size);
- check_malloc_return (name_expand);
- openvpn_snprintf (name_expand, name_expand_size, "X509_%d_%s", depth, name);
- setenv_str (es, name_expand, value);
- free (name_expand);
+ char *name_expand;
+ size_t name_expand_size;
+
+ string_mod(value, CC_ANY, CC_CRLF, '?');
+ msg(D_X509_ATTR, "X509 ATTRIBUTE name='%s' value='%s' depth=%d", name, value, depth);
+ name_expand_size = 64 + strlen(name);
+ name_expand = (char *) malloc(name_expand_size);
+ check_malloc_return(name_expand);
+ openvpn_snprintf(name_expand, name_expand_size, "X509_%d_%s", depth, name);
+ setenv_str(es, name_expand, value);
+ free(name_expand);
}
static char *
asn1_buf_to_c_string(const mbedtls_asn1_buf *orig, struct gc_arena *gc)
{
- size_t i;
- char *val;
-
- for (i = 0; i < orig->len; ++i)
- if (orig->p[i] == '\0')
- return "ERROR: embedded null value";
- val = gc_malloc(orig->len+1, false, gc);
- memcpy(val, orig->p, orig->len);
- val[orig->len] = '\0';
- return val;
+ size_t i;
+ char *val;
+
+ for (i = 0; i < orig->len; ++i)
+ if (orig->p[i] == '\0')
+ {
+ return "ERROR: embedded null value";
+ }
+ val = gc_malloc(orig->len+1, false, gc);
+ memcpy(val, orig->p, orig->len);
+ val[orig->len] = '\0';
+ return val;
}
static void
do_setenv_name(struct env_set *es, const struct x509_track *xt,
- const mbedtls_x509_crt *cert, int depth, struct gc_arena *gc)
+ const mbedtls_x509_crt *cert, int depth, struct gc_arena *gc)
{
- const mbedtls_x509_name *xn;
- for (xn = &cert->subject; xn != NULL; xn = xn->next)
+ const mbedtls_x509_name *xn;
+ for (xn = &cert->subject; xn != NULL; xn = xn->next)
{
- const char *xn_short_name = NULL;
- if (0 == mbedtls_oid_get_attr_short_name (&xn->oid, &xn_short_name) &&
- 0 == strcmp (xt->name, xn_short_name))
- {
- char *val_str = asn1_buf_to_c_string (&xn->val, gc);
- do_setenv_x509 (es, xt->name, val_str, depth);
- }
+ const char *xn_short_name = NULL;
+ if (0 == mbedtls_oid_get_attr_short_name(&xn->oid, &xn_short_name)
+ && 0 == strcmp(xt->name, xn_short_name))
+ {
+ char *val_str = asn1_buf_to_c_string(&xn->val, gc);
+ do_setenv_x509(es, xt->name, val_str, depth);
+ }
}
}
void
-x509_track_add (const struct x509_track **ll_head, const char *name, int msglevel, struct gc_arena *gc)
+x509_track_add(const struct x509_track **ll_head, const char *name, int msglevel, struct gc_arena *gc)
{
- struct x509_track *xt;
- ALLOC_OBJ_CLEAR_GC (xt, struct x509_track, gc);
- if (*name == '+')
+ struct x509_track *xt;
+ ALLOC_OBJ_CLEAR_GC(xt, struct x509_track, gc);
+ if (*name == '+')
{
- xt->flags |= XT_FULL_CHAIN;
- ++name;
+ xt->flags |= XT_FULL_CHAIN;
+ ++name;
}
- xt->name = name;
- xt->next = *ll_head;
- *ll_head = xt;
+ xt->name = name;
+ xt->next = *ll_head;
+ *ll_head = xt;
}
void
-x509_setenv_track (const struct x509_track *xt, struct env_set *es,
- const int depth, mbedtls_x509_crt *cert)
+x509_setenv_track(const struct x509_track *xt, struct env_set *es,
+ const int depth, mbedtls_x509_crt *cert)
{
- struct gc_arena gc = gc_new();
- while (xt)
+ struct gc_arena gc = gc_new();
+ while (xt)
{
- if (depth == 0 || (xt->flags & XT_FULL_CHAIN))
- {
- if (0 == strcmp(xt->name, "SHA1") || 0 == strcmp(xt->name, "SHA256"))
- {
- /* Fingerprint is not part of X509 structure */
- struct buffer cert_hash;
- char *fingerprint;
-
- if (0 == strcmp(xt->name, "SHA1"))
- cert_hash = x509_get_sha1_fingerprint(cert, &gc);
- else
- cert_hash = x509_get_sha256_fingerprint(cert, &gc);
-
- fingerprint = format_hex_ex(BPTR(&cert_hash),
- BLEN(&cert_hash), 0, 1 | FHE_CAPS, ":", &gc);
- do_setenv_x509(es, xt->name, fingerprint, depth);
- }
- else
- {
- do_setenv_name(es, xt, cert, depth, &gc);
- }
- }
- xt = xt->next;
+ if (depth == 0 || (xt->flags & XT_FULL_CHAIN))
+ {
+ if (0 == strcmp(xt->name, "SHA1") || 0 == strcmp(xt->name, "SHA256"))
+ {
+ /* Fingerprint is not part of X509 structure */
+ struct buffer cert_hash;
+ char *fingerprint;
+
+ if (0 == strcmp(xt->name, "SHA1"))
+ {
+ cert_hash = x509_get_sha1_fingerprint(cert, &gc);
+ }
+ else
+ {
+ cert_hash = x509_get_sha256_fingerprint(cert, &gc);
+ }
+
+ fingerprint = format_hex_ex(BPTR(&cert_hash),
+ BLEN(&cert_hash), 0, 1 | FHE_CAPS, ":", &gc);
+ do_setenv_x509(es, xt->name, fingerprint, depth);
+ }
+ else
+ {
+ do_setenv_name(es, xt, cert, depth, &gc);
+ }
+ }
+ xt = xt->next;
}
- gc_free(&gc);
+ gc_free(&gc);
}
/*
@@ -343,146 +355,159 @@ x509_setenv_track (const struct x509_track *xt, struct env_set *es,
* X509_{cert_depth}_{name}={value}
*/
void
-x509_setenv (struct env_set *es, int cert_depth, mbedtls_x509_crt *cert)
+x509_setenv(struct env_set *es, int cert_depth, mbedtls_x509_crt *cert)
{
- int i;
- unsigned char c;
- const mbedtls_x509_name *name;
- char s[128] = { 0 };
+ int i;
+ unsigned char c;
+ const mbedtls_x509_name *name;
+ char s[128] = { 0 };
- name = &cert->subject;
+ name = &cert->subject;
- while( name != NULL )
+ while (name != NULL)
{
- char name_expand[64+8];
- const char *shortname;
-
- if( 0 == mbedtls_oid_get_attr_short_name(&name->oid, &shortname) )
- {
- openvpn_snprintf (name_expand, sizeof(name_expand), "X509_%d_%s",
- cert_depth, shortname);
- }
- else
- {
- openvpn_snprintf (name_expand, sizeof(name_expand), "X509_%d_\?\?",
- cert_depth);
- }
-
- for( i = 0; i < name->val.len; i++ )
- {
- if( i >= (int) sizeof( s ) - 1 )
- break;
-
- c = name->val.p[i];
- if( c < 32 || c == 127 || ( c > 128 && c < 160 ) )
- s[i] = '?';
- else s[i] = c;
- }
- s[i] = '\0';
-
- /* Check both strings, set environment variable */
- string_mod (name_expand, CC_PRINT, CC_CRLF, '_');
- string_mod ((char*)s, CC_PRINT, CC_CRLF, '_');
- setenv_str_incr (es, name_expand, (char*)s);
-
- name = name->next;
+ char name_expand[64+8];
+ const char *shortname;
+
+ if (0 == mbedtls_oid_get_attr_short_name(&name->oid, &shortname) )
+ {
+ openvpn_snprintf(name_expand, sizeof(name_expand), "X509_%d_%s",
+ cert_depth, shortname);
+ }
+ else
+ {
+ openvpn_snprintf(name_expand, sizeof(name_expand), "X509_%d_\?\?",
+ cert_depth);
+ }
+
+ for (i = 0; i < name->val.len; i++)
+ {
+ if (i >= (int) sizeof( s ) - 1)
+ {
+ break;
+ }
+
+ c = name->val.p[i];
+ if (c < 32 || c == 127 || ( c > 128 && c < 160 ) )
+ {
+ s[i] = '?';
+ }
+ else
+ {
+ s[i] = c;
+ }
+ }
+ s[i] = '\0';
+
+ /* Check both strings, set environment variable */
+ string_mod(name_expand, CC_PRINT, CC_CRLF, '_');
+ string_mod((char *)s, CC_PRINT, CC_CRLF, '_');
+ setenv_str_incr(es, name_expand, (char *)s);
+
+ name = name->next;
}
}
result_t
x509_verify_ns_cert_type(const mbedtls_x509_crt *cert, const int usage)
{
- if (usage == NS_CERT_CHECK_NONE)
- return SUCCESS;
- if (usage == NS_CERT_CHECK_CLIENT)
- return ((cert->ext_types & MBEDTLS_X509_EXT_NS_CERT_TYPE)
- && (cert->ns_cert_type & MBEDTLS_X509_NS_CERT_TYPE_SSL_CLIENT)) ?
- SUCCESS : FAILURE;
- if (usage == NS_CERT_CHECK_SERVER)
- return ((cert->ext_types & MBEDTLS_X509_EXT_NS_CERT_TYPE)
- && (cert->ns_cert_type & MBEDTLS_X509_NS_CERT_TYPE_SSL_SERVER)) ?
- SUCCESS : FAILURE;
-
- return FAILURE;
+ if (usage == NS_CERT_CHECK_NONE)
+ {
+ return SUCCESS;
+ }
+ if (usage == NS_CERT_CHECK_CLIENT)
+ {
+ return ((cert->ext_types & MBEDTLS_X509_EXT_NS_CERT_TYPE)
+ && (cert->ns_cert_type & MBEDTLS_X509_NS_CERT_TYPE_SSL_CLIENT)) ?
+ SUCCESS : FAILURE;
+ }
+ if (usage == NS_CERT_CHECK_SERVER)
+ {
+ return ((cert->ext_types & MBEDTLS_X509_EXT_NS_CERT_TYPE)
+ && (cert->ns_cert_type & MBEDTLS_X509_NS_CERT_TYPE_SSL_SERVER)) ?
+ SUCCESS : FAILURE;
+ }
+
+ return FAILURE;
}
result_t
-x509_verify_cert_ku (mbedtls_x509_crt *cert, const unsigned * const expected_ku,
- int expected_len)
+x509_verify_cert_ku(mbedtls_x509_crt *cert, const unsigned *const expected_ku,
+ int expected_len)
{
- result_t fFound = FAILURE;
+ result_t fFound = FAILURE;
- if(!(cert->ext_types & MBEDTLS_X509_EXT_KEY_USAGE))
+ if (!(cert->ext_types & MBEDTLS_X509_EXT_KEY_USAGE))
{
- msg (D_HANDSHAKE, "Certificate does not have key usage extension");
+ msg(D_HANDSHAKE, "Certificate does not have key usage extension");
}
- else
+ else
{
- int i;
- unsigned nku = cert->key_usage;
-
- msg (D_HANDSHAKE, "Validating certificate key usage");
- for (i=0; SUCCESS != fFound && i<expected_len; i++)
- {
- if (expected_ku[i] != 0)
- {
- msg (D_HANDSHAKE, "++ Certificate has key usage %04x, expects "
- "%04x", nku, expected_ku[i]);
-
- if (nku == expected_ku[i])
- {
- fFound = SUCCESS;
- }
- }
- }
+ int i;
+ unsigned nku = cert->key_usage;
+
+ msg(D_HANDSHAKE, "Validating certificate key usage");
+ for (i = 0; SUCCESS != fFound && i<expected_len; i++)
+ {
+ if (expected_ku[i] != 0)
+ {
+ msg(D_HANDSHAKE, "++ Certificate has key usage %04x, expects "
+ "%04x", nku, expected_ku[i]);
+
+ if (nku == expected_ku[i])
+ {
+ fFound = SUCCESS;
+ }
+ }
+ }
}
- return fFound;
+ return fFound;
}
result_t
-x509_verify_cert_eku (mbedtls_x509_crt *cert, const char * const expected_oid)
+x509_verify_cert_eku(mbedtls_x509_crt *cert, const char *const expected_oid)
{
- result_t fFound = FAILURE;
+ result_t fFound = FAILURE;
- if (!(cert->ext_types & MBEDTLS_X509_EXT_EXTENDED_KEY_USAGE))
+ if (!(cert->ext_types & MBEDTLS_X509_EXT_EXTENDED_KEY_USAGE))
{
- msg (D_HANDSHAKE, "Certificate does not have extended key usage extension");
+ msg(D_HANDSHAKE, "Certificate does not have extended key usage extension");
}
- else
+ else
{
- mbedtls_x509_sequence *oid_seq = &(cert->ext_key_usage);
-
- msg (D_HANDSHAKE, "Validating certificate extended key usage");
- while (oid_seq != NULL)
- {
- mbedtls_x509_buf *oid = &oid_seq->buf;
- char oid_num_str[1024];
- const char *oid_str;
-
- if (0 == mbedtls_oid_get_extended_key_usage( oid, &oid_str ))
- {
- msg (D_HANDSHAKE, "++ Certificate has EKU (str) %s, expects %s",
- oid_str, expected_oid);
- if (!strcmp (expected_oid, oid_str))
- {
- fFound = SUCCESS;
- break;
- }
- }
-
- if (0 < mbedtls_oid_get_numeric_string( oid_num_str,
- sizeof (oid_num_str), oid))
- {
- msg (D_HANDSHAKE, "++ Certificate has EKU (oid) %s, expects %s",
- oid_num_str, expected_oid);
- if (!strcmp (expected_oid, oid_num_str))
- {
- fFound = SUCCESS;
- break;
- }
- }
- oid_seq = oid_seq->next;
- }
+ mbedtls_x509_sequence *oid_seq = &(cert->ext_key_usage);
+
+ msg(D_HANDSHAKE, "Validating certificate extended key usage");
+ while (oid_seq != NULL)
+ {
+ mbedtls_x509_buf *oid = &oid_seq->buf;
+ char oid_num_str[1024];
+ const char *oid_str;
+
+ if (0 == mbedtls_oid_get_extended_key_usage( oid, &oid_str ))
+ {
+ msg(D_HANDSHAKE, "++ Certificate has EKU (str) %s, expects %s",
+ oid_str, expected_oid);
+ if (!strcmp(expected_oid, oid_str))
+ {
+ fFound = SUCCESS;
+ break;
+ }
+ }
+
+ if (0 < mbedtls_oid_get_numeric_string( oid_num_str,
+ sizeof(oid_num_str), oid))
+ {
+ msg(D_HANDSHAKE, "++ Certificate has EKU (oid) %s, expects %s",
+ oid_num_str, expected_oid);
+ if (!strcmp(expected_oid, oid_num_str))
+ {
+ fFound = SUCCESS;
+ break;
+ }
+ }
+ oid_seq = oid_seq->next;
+ }
}
return fFound;
@@ -491,19 +516,19 @@ x509_verify_cert_eku (mbedtls_x509_crt *cert, const char * const expected_oid)
result_t
x509_write_pem(FILE *peercert_file, mbedtls_x509_crt *peercert)
{
- msg (M_WARN, "mbed TLS does not support writing peer certificate in PEM format");
+ msg(M_WARN, "mbed TLS does not support writing peer certificate in PEM format");
return FAILURE;
}
bool
tls_verify_crl_missing(const struct tls_options *opt)
{
- if (opt->crl_file && !(opt->ssl_flags & SSLF_CRL_VERIFY_DIR)
- && (opt->ssl_ctx.crl == NULL || opt->ssl_ctx.crl->version == 0))
+ if (opt->crl_file && !(opt->ssl_flags & SSLF_CRL_VERIFY_DIR)
+ && (opt->ssl_ctx.crl == NULL || opt->ssl_ctx.crl->version == 0))
{
- return true;
+ return true;
}
- return false;
+ return false;
}
#endif /* #if defined(ENABLE_CRYPTO) && defined(ENABLE_CRYPTO_MBEDTLS) */