lib/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2025-07-29 11:41:15 +03:00
Code Activity

Check keyUsage in SSL client and server

Browse Source
This commit is contained in:
Manuel Pégourié-Gonnard
2014-04-09 09:50:57 +02:00
committed by Paul Bakker
parent 603116c570
commit 7f2a07d7b2
11 changed files with 347 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
library/ssl_srv.c
View File

@ -797,6 +797,20 @@ static int ssl_pick_cert( ssl_context *ssl,
if( ! pk_can_do( cur->key, pk_alg ) )
continue;
/*
* This avoids sending the client a cert it'll reject based on
* keyUsage or other extensions.
*
* It also allows the user to provision different certificates for
* different uses based on keyUsage, eg if they want to avoid signing
* and decrypting with the same RSA key.
*/
if( ssl_check_cert_usage( cur->cert, ciphersuite_info,
SSL_IS_SERVER ) != 0 )
{
continue;
}
#if defined(POLARSSL_ECDSA_C)
if( pk_alg == POLARSSL_PK_ECDSA )
{