TeamHepta/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-04-24 04:35:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fail when ExtendedKeyUsage extension not present

Browse Source 
The existing Mbed TLS API to check whether the ExtendedKeyUsage
extension allows an operation. However, this API succeeds when the
extension is not present in the certificate. In the case of authorised
signers for OCSP responses, the certificate MUST have the extension AND
the OCSPSigning field set to be accepted.

This commit creates the new function
mbedtls_x509_crt_check_extended_key_usage_ext() which is a version of
mbedtls_x509_crt_check_extended_key_usage() that returns an error code
if the extension is not present in the certificate in question.
This commit is contained in:
Andres Amaya Garcia
2018-03-15 21:52:46 +00:00
parent 9830d19bf8
commit 75d24d8e35
3 changed files with 33 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
include/mbedtls/x509_crt.h
View File

@@ -382,14 +382,32 @@ int mbedtls_x509_crt_check_key_usage( const mbedtls_x509_crt *crt,
* \param usage_oid Intended usage (eg MBEDTLS_OID_SERVER_AUTH or MBEDTLS_OID_CLIENT_AUTH).
* \param usage_len Length of usage_oid (eg given by MBEDTLS_OID_SIZE()).
*
* \return 0 if this use of the certificate is allowed,
* MBEDTLS_ERR_X509_BAD_INPUT_DATA if not.
* \return 0 if this use of the certificate is allowed or the extension
* is not present, otherwise MBEDTLS_ERR_X509_BAD_INPUT_DATA.
*
* \note Usually only makes sense on leaf certificates.
*/
int mbedtls_x509_crt_check_extended_key_usage( const mbedtls_x509_crt *crt,
const char *usage_oid,
size_t usage_len );
/**
* \brief Check usage of certificate against extentedKeyUsage.
*
* \param crt Leaf certificate used.
* \param usage_oid Intended usage (eg MBEDTLS_OID_SERVER_AUTH or
* MBEDTLS_OID_CLIENT_AUTH).
* \param usage_len Length of usage_oid (eg given by MBEDTLS_OID_SIZE()).
*
* \return 0 if this use of the certificate is allowed, or
* MBEDTLS_ERR_X509_BAD_INPUT_DATA if the extension is not
* present or the usage is not allowed.
*
* \note Usually only makes sense on leaf certificates.
*/
int mbedtls_x509_crt_check_extended_key_usage_ext( const mbedtls_x509_crt *crt,
const char *usage_oid,
size_t usage_len );
#endif /* MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE) */
#if defined(MBEDTLS_X509_CRL_PARSE_C)

12
library/x509_crt.c
View File

@@ -1799,6 +1799,18 @@ int mbedtls_x509_crt_check_extended_key_usage( const mbedtls_x509_crt *crt,
return( MBEDTLS_ERR_X509_BAD_INPUT_DATA );
}
int mbedtls_x509_crt_check_extended_key_usage_ext( const mbedtls_x509_crt *crt,
const char *usage_oid,
size_t usage_len )
{
/* Extension is not mandatory, absent means no restriction */
if( ( crt->ext_types & MBEDTLS_X509_EXT_EXTENDED_KEY_USAGE ) == 0 )
return( MBEDTLS_ERR_X509_BAD_INPUT_DATA );
return( mbedtls_x509_crt_check_extended_key_usage( crt, usage_oid,
usage_len ) );
}
#endif /* MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE */
#if defined(MBEDTLS_X509_CRL_PARSE_C)

2
library/x509_ocsp.c
View File

@@ -1548,7 +1548,7 @@ static int x509_ocsp_verify_response_issuer(
#if defined(MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE)
/* Check that the issuer includes the value of id-kp-OCSPSigning */
if( ( ret = mbedtls_x509_crt_check_extended_key_usage( issuer,
if( ( ret = mbedtls_x509_crt_check_extended_key_usage_ext( issuer,
MBEDTLS_OID_OCSP_SIGNING,
MBEDTLS_OID_SIZE( MBEDTLS_OID_OCSP_SIGNING ) ) ) != 0 )
{