Add keyUsage checking for CAs
diff --git a/library/x509_crt.c b/library/x509_crt.c
index be2e526..47745a7 100644
--- a/library/x509_crt.c
+++ b/library/x509_crt.c
@@ -1425,6 +1425,17 @@
}
/*
+ * Check if the CA is configured to sign CRLs
+ */
+#if defined(POLARSSL_X509_CHECK_KEY_USAGE)
+ if( x509_crt_check_key_usage( ca, KU_CRL_SIGN ) != 0 )
+ {
+ flags |= BADCRL_NOT_TRUSTED;
+ break;
+ }
+#endif
+
+ /*
* Check if CRL is correctly signed by the trusted CA
*/
md_info = md_info_from_type( crl_list->sig_md );
@@ -1548,6 +1559,11 @@
continue;
}
+#if defined(POLARSSL_X509_CHECK_KEY_USAGE)
+ if( x509_crt_check_key_usage( parent, KU_KEY_CERT_SIGN ) != 0 )
+ continue;
+#endif
+
/* If we get there, we found a suitable parent */
break;
}
@@ -1599,6 +1615,14 @@
continue;
}
+#if defined(POLARSSL_X509_CHECK_KEY_USAGE)
+ if( x509_crt_check_key_usage( trust_ca, KU_KEY_CERT_SIGN ) != 0 )
+ {
+ trust_ca = trust_ca->next;
+ continue;
+ }
+#endif
+
/*
* Reduce path_len to check against if top of the chain is
* the same as the trusted CA