commit e16b62c3a9533dfe4d896e2c373c4484b1326d01
author Manuel Pégourié-Gonnard <mpg@elzevir.fr> Fri Apr 17 16:55:53 2015 +0200
committer Manuel Pégourié-Gonnard <mpg@elzevir.fr> Wed Apr 29 17:07:31 2015 +0200
tree 7773e22a1b47cecb6c2c9779ca4b283fa3f9c893
parent 770b5e1e9e043a00f79276d588c8c7437c0b774c

Make results of (ext)KeyUsage accessible

library/ssl_srv.c

diff --git a/library/ssl_srv.c b/library/ssl_srv.c
index dad6872..5f01a01 100644
--- a/library/ssl_srv.c
+++ b/library/ssl_srv.c
@@ -829,6 +829,7 @@
 {
     ssl_key_cert *cur, *list, *fallback = NULL;
     pk_type_t pk_alg = ssl_get_ciphersuite_sig_pk_alg( ciphersuite_info );
+    int flags;
 
 #if defined(POLARSSL_SSL_SERVER_NAME_INDICATION)
     if( ssl->handshake->sni_key_cert != NULL )
@@ -862,7 +863,7 @@
          * and decrypting with the same RSA key.
          */
         if( ssl_check_cert_usage( cur->cert, ciphersuite_info,
-                                  SSL_IS_SERVER ) != 0 )
+                                  SSL_IS_SERVER, &flags ) != 0 )
         {
             SSL_DEBUG_MSG( 3, ( "certificate mismatch: "
                                 "(extended) key usage extension" ) );

library/ssl_tls.c

diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index d2e0c52..72cd6d2 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -2859,7 +2859,8 @@
 
         if( ssl_check_cert_usage( ssl->session_negotiate->peer_cert,
                                   ciphersuite_info,
-                                  ! ssl->endpoint ) != 0 )
+                                  ! ssl->endpoint,
+                                 &ssl->session_negotiate->verify_result ) != 0 )
         {
             SSL_DEBUG_MSG( 1, ( "bad certificate (usage extensions)" ) );
             if( ret == 0 )
@@ -5199,8 +5200,10 @@
 #if defined(POLARSSL_X509_CRT_PARSE_C)
 int ssl_check_cert_usage( const x509_crt *cert,
                           const ssl_ciphersuite_t *ciphersuite,
-                          int cert_endpoint )
+                          int cert_endpoint,
+                          int *flags )
 {
+    int ret = 0;
 #if defined(POLARSSL_X509_CHECK_KEY_USAGE)
     int usage = 0;
 #endif
@@ -5213,6 +5216,7 @@
     !defined(POLARSSL_X509_CHECK_EXTENDED_KEY_USAGE)
     ((void) cert);
     ((void) cert_endpoint);
+    ((void) flags);
 #endif
 
 #if defined(POLARSSL_X509_CHECK_KEY_USAGE)
@@ -5252,7 +5256,10 @@
     }
 
     if( x509_crt_check_key_usage( cert, usage ) != 0 )
-        return( -1 );
+    {
+        *flags |= BADCERT_KEY_USAGE;
+        ret = -1;
+    }
 #else
     ((void) ciphersuite);
 #endif /* POLARSSL_X509_CHECK_KEY_USAGE */
@@ -5270,10 +5277,13 @@
     }
 
     if( x509_crt_check_extended_key_usage( cert, ext_oid, ext_len ) != 0 )
-        return( -1 );
+    {
+        *flags |= BADCERT_EXT_KEY_USAGE;
+        ret = -1;
+    }
 #endif /* POLARSSL_X509_CHECK_EXTENDED_KEY_USAGE */
 
-    return( 0 );
+    return( ret );
 }
 #endif /* POLARSSL_X509_CRT_PARSE_C */