feedc0de/wolfssl
1
0
Fork 0
forked from wolfSSL/wolfssl
Code Pull Requests Activity

Adds WOLFSSL_NO_OCSP_EXTKEYUSE_OCSP_SIGN option to provide backwards compatibility option for OCSP checking.

Browse Source
This commit is contained in:
David Garske
2017-06-21 10:52:11 -07:00
parent 7a3769f435
commit a3578c6643
1 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
wolfcrypt/src/asn.c
View File

@@ -36,10 +36,13 @@ ASN Options:
* WOLFSSL_CERT_GEN: Cert generation. Saves extra certificate info in GetName. * WOLFSSL_CERT_GEN: Cert generation. Saves extra certificate info in GetName.
* WOLFSSL_NO_OCSP_OPTIONAL_CERTS: Skip optional OCSP certs (responder issuer * WOLFSSL_NO_OCSP_OPTIONAL_CERTS: Skip optional OCSP certs (responder issuer
must still be trusted) must still be trusted)
* WOLFSSL_NO_TRUSTED_CERTS_VERIFY: Workaround for sitatuon where entire cert * WOLFSSL_NO_TRUSTED_CERTS_VERIFY: Workaround for situation where entire cert
chain is not loaded. This only matches on subject and public key and chain is not loaded. This only matches on subject and public key and
does not perform a PKI validation, so it is not a secure solution. does not perform a PKI validation, so it is not a secure solution.
Only enabled for OCSP. Only enabled for OCSP.
* WOLFSSL_NO_OCSP_EXTKEYUSE_OCSP_SIGN: Can be defined for backwards
compatibility to disable matching of OCSP signing authority for the
certificate in question.
*/ */
#ifndef NO_ASN #ifndef NO_ASN
@@ -10767,6 +10770,7 @@ static int DecodeBasicOcspResponse(byte* source, word32* ioIndex,
return ret; return ret;
} }
#ifndef WOLFSSL_NO_OCSP_EXTKEYUSE_OCSP_SIGN
if ((cert.extExtKeyUsage & EXTKEYUSE_OCSP_SIGN) == 0) { if ((cert.extExtKeyUsage & EXTKEYUSE_OCSP_SIGN) == 0) {
if (XMEMCMP(cert.subjectHash, if (XMEMCMP(cert.subjectHash,
resp->issuerHash, KEYID_SIZE) == 0) { resp->issuerHash, KEYID_SIZE) == 0) {
@@ -10779,6 +10783,7 @@ static int DecodeBasicOcspResponse(byte* source, word32* ioIndex,
return BAD_OCSP_RESPONDER; return BAD_OCSP_RESPONDER;
} }
} }
#endif
/* ConfirmSignature is blocking here */ /* ConfirmSignature is blocking here */
ret = ConfirmSignature(&cert.sigCtx, ret = ConfirmSignature(&cert.sigCtx,