lib/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2025-07-25 02:02:03 +03:00
Code Activity

Merge pull request #5620 from gstrauss/dn_hints

Browse Source 
Add accessors to config DN hints for cert request
This commit is contained in:
Paul Elliott
2022-07-01 17:23:14 +01:00
committed by GitHub
parent 7922bfbd47 bd10c4e2af
commit bae7a1a5a6
8 changed files with 168 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

39
include/mbedtls/ssl.h
View File

@ -1496,6 +1496,10 @@ struct mbedtls_ssl_config
#if defined(MBEDTLS_SSL_SRV_C)
mbedtls_ssl_hs_cb_t MBEDTLS_PRIVATE(f_cert_cb); /*!< certificate selection callback */
#endif /* MBEDTLS_SSL_SRV_C */
#if defined(MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED)
const mbedtls_x509_crt *MBEDTLS_PRIVATE(dn_hints);/*!< acceptable client cert issuers */
#endif
};
struct mbedtls_ssl_context
@ -3128,6 +3132,26 @@ void mbedtls_ssl_conf_ca_chain( mbedtls_ssl_config *conf,
mbedtls_x509_crt *ca_chain,
mbedtls_x509_crl *ca_crl );
#if defined(MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED)
/**
* \brief Set DN hints sent to client in CertificateRequest message
*
* \note If not set, subject distinguished names (DNs) are taken
* from \c mbedtls_ssl_conf_ca_chain()
* or \c mbedtls_ssl_set_hs_ca_chain())
*
* \param conf SSL configuration
* \param crt crt chain whose subject DNs are issuer DNs of client certs
* from which the client should select client peer certificate.
*/
static inline
void mbedtls_ssl_conf_dn_hints( mbedtls_ssl_config *conf,
const mbedtls_x509_crt *crt )
{
conf->MBEDTLS_PRIVATE(dn_hints) = crt;
}
#endif /* MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED */
#if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)
/**
* \brief Set the trusted certificate callback.
@ -3652,6 +3676,21 @@ void mbedtls_ssl_set_hs_ca_chain( mbedtls_ssl_context *ssl,
mbedtls_x509_crt *ca_chain,
mbedtls_x509_crl *ca_crl );
#if defined(MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED)
/**
* \brief Set DN hints sent to client in CertificateRequest message
*
* \note Same as \c mbedtls_ssl_conf_dn_hints() but for use within
* the SNI callback or the certificate selection callback.
*
* \param ssl SSL context
* \param crt crt chain whose subject DNs are issuer DNs of client certs
* from which the client should select client peer certificate.
*/
void mbedtls_ssl_set_hs_dn_hints( mbedtls_ssl_context *ssl,
const mbedtls_x509_crt *crt );
#endif /* MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED */
/**
* \brief Set authmode for the current handshake.
*