Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Set call back to delegate entire certificate validation process #94

Open
wants to merge 1 commit into
base: tls13-prototype
Choose a base branch
from
Open

Set call back to delegate entire certificate validation process #94

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 23 additions & 0 deletions include/mbedtls/ssl.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1221,6 +1221,10 @@ struct mbedtls_ssl_config
/** Callback to customize X.509 certificate chain verification */
int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *);
void *p_vrfy; /*!< context for X.509 verify calllback */
#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) && defined(MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL)
int (*f_verify_callback)(void *, const mbedtls_x509_crt *, const char *);
void *p_verify_callback;
#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION && MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL */
#endif /* MBEDTLS_X509_CRT_PARSE_C */

#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
Expand Down Expand Up @@ -1953,6 +1957,25 @@ void mbedtls_ssl_conf_early_data(mbedtls_ssl_config* conf, int early_data, char*
void mbedtls_ssl_conf_verify( mbedtls_ssl_config *conf,
int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
void *p_vrfy );
#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) && defined(MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL)
/**
* \brief Set the verification callback (Optional).
*
* If the application does not explicitly specify a
* verification callback function, the built-in verification
* function is used. If a verification callback is specified via
* mbedtls_ssl_conf_set_verify_callback(), the supplied callback
* function is called instead. By setting callback to NULL, the
* default behaviour is restored.
*
* \param conf SSL configuration
* \param f_verify_callback verification function
* \param p_verify_callback verification parameter
*/
void mbedtls_ssl_conf_set_verify_callback( mbedtls_ssl_config *conf,
int (*f_verify_callback)(void *, const mbedtls_x509_crt *, const char *),
void *p_verify_callback );
#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION && MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL */
#endif /* MBEDTLS_X509_CRT_PARSE_C */

#if defined(MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL) && defined(MBEDTLS_X509_CRT_PARSE_C)
Expand Down
10 changes: 10 additions & 0 deletions library/ssl_tls.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4514,6 +4514,16 @@ void mbedtls_ssl_conf_verify( mbedtls_ssl_config *conf,
conf->f_vrfy = f_vrfy;
conf->p_vrfy = p_vrfy;
}

#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) && defined(MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL)
void mbedtls_ssl_conf_set_verify_callback( mbedtls_ssl_config *conf,
int (*f_verify_callback)(void *, const mbedtls_x509_crt *, const char *),
void *p_verify_callback ) {
conf->f_verify_callback = f_verify_callback;
conf->p_verify_callback = p_verify_callback;
}
#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION && MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL */

#endif /* MBEDTLS_X509_CRT_PARSE_C */

void mbedtls_ssl_conf_rng( mbedtls_ssl_config *conf,
Expand Down
27 changes: 24 additions & 3 deletions library/ssl_tls13_generic.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2912,8 +2912,9 @@ static int ssl_read_certificate_validate( mbedtls_ssl_context* ssl )
{
int ret = 0;
int authmode = ssl->conf->authmode;
mbedtls_x509_crt* ca_chain;
mbedtls_x509_crl* ca_crl;
int have_ca_chain = 0;
mbedtls_x509_crt* ca_chain = NULL;
mbedtls_x509_crl* ca_crl = NULL;

/* If SNI was used, overwrite authentication mode
* from the configuration. */
Expand Down Expand Up @@ -2961,6 +2962,21 @@ static int ssl_read_certificate_validate( mbedtls_ssl_context* ssl )
return( 0 );
}

#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
if (ssl->conf->f_verify_callback) {
if (ssl->conf->f_verify_callback(
ssl->conf->p_verify_callback,
ssl->session_negotiate->peer_cert,
ssl->hostname) != 0)
{
ssl->session_negotiate->verify_result |= MBEDTLS_X509_BADCERT_OTHER;
ret = MBEDTLS_ERR_X509_CERT_VERIFY_FAILED;
}
have_ca_chain = 1;
}
else
#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
{
#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
if( ssl->handshake->sni_ca_chain != NULL )
{
Expand All @@ -2974,6 +2990,8 @@ static int ssl_read_certificate_validate( mbedtls_ssl_context* ssl )
ca_crl = ssl->conf->ca_crl;
}

if( ca_chain != NULL )
have_ca_chain = 1;
/*
* Main check: verify certificate
*/
Expand All @@ -2984,10 +3002,13 @@ static int ssl_read_certificate_validate( mbedtls_ssl_context* ssl )
ssl->hostname,
&ssl->session_negotiate->verify_result,
ssl->conf->f_vrfy, ssl->conf->p_vrfy );
}

if( ret != 0 )
{
MBEDTLS_SSL_DEBUG_RET( 1, "x509_verify_cert", ret );
mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
MBEDTLS_SSL_ALERT_MSG_CERT_UNKNOWN);
}

/*
Expand Down Expand Up @@ -3034,7 +3055,7 @@ static int ssl_read_certificate_validate( mbedtls_ssl_context* ssl )
ret = 0;
}

if( ca_chain == NULL && authmode == MBEDTLS_SSL_VERIFY_REQUIRED )
if( have_ca_chain == 0 && authmode == MBEDTLS_SSL_VERIFY_REQUIRED )
{
MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no CA chain" ) );
ret = MBEDTLS_ERR_SSL_CA_CHAIN_REQUIRED;
Expand Down