coffee/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-07-30 16:26:33 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge 53093ce4bd6ed5f938f31925265a22a14022896f into 3bb373867917b674265067cbd38b9d252c43d014

Browse Source
This commit is contained in:
Antonis Skourtis 2026-07-20 21:08:22 +01:00 committed by GitHub
commit f61507db56
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 74 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
ChangeLog.d/fix-critical-extension-handling.txt Normal file
View File

@ -0,0 +1,3 @@
Bugfix
* Add critical extension handling support for TLS peer x509 certificates.
Fixes issue #7182.

37
include/mbedtls/ssl.h
View File

@ -1432,6 +1432,10 @@ struct mbedtls_ssl_config {
/** Callback to customize X.509 certificate chain verification */
int(*MBEDTLS_PRIVATE(f_vrfy))(void *, mbedtls_x509_crt *, int, uint32_t *);
void *MBEDTLS_PRIVATE(p_vrfy); /*!< context for X.509 verify calllback */
/** Callback to skip unsupported extentions */
mbedtls_x509_crt_ext_cb_t MBEDTLS_PRIVATE(f_ext);
void *MBEDTLS_PRIVATE(p_ext); /*!< context for X.509 extention calllback */
#endif
#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED)
@ -1649,6 +1653,10 @@ struct mbedtls_ssl_context {
/** Callback to customize X.509 certificate chain verification */
int(*MBEDTLS_PRIVATE(f_vrfy))(void *, mbedtls_x509_crt *, int, uint32_t *);
void *MBEDTLS_PRIVATE(p_vrfy); /*!< context for X.509 verify callback */
/** Callback to skip unsupported extentions */
mbedtls_x509_crt_ext_cb_t MBEDTLS_PRIVATE(f_ext);
void *MBEDTLS_PRIVATE(p_ext); /*!< context for X.509 extention calllback */
#endif
mbedtls_ssl_send_t *MBEDTLS_PRIVATE(f_send); /*!< Callback for network send */
@ -2102,6 +2110,21 @@ void mbedtls_ssl_conf_max_early_data_size(
void mbedtls_ssl_conf_verify(mbedtls_ssl_config *conf,
int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
void *p_vrfy);
/**
* \brief Set the unsupported extention callback (Optional).
*
* If set, the provided extention callback is called whenever
* a certificate is parsed. For more information, please see
* the documentation of
* \c mbedtls_x509_crt_parse_der_with_ext_cb().
*
* \param conf The SSL configuration to use.
* \param f_ext The extentions callback to use during CRT parsing.
* \param p_ext The opaque context to be passed to the callback.
*/
void mbedtls_ssl_conf_ext_cb(mbedtls_ssl_config *conf, mbedtls_x509_crt_ext_cb_t f_ext,
void *p_ext);
#endif /* MBEDTLS_X509_CRT_PARSE_C */
/**
@ -2410,6 +2433,20 @@ void mbedtls_ssl_set_mtu(mbedtls_ssl_context *ssl, uint16_t mtu);
void mbedtls_ssl_set_verify(mbedtls_ssl_context *ssl,
int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
void *p_vrfy);
/**
* \brief Set a connection-specific extention callback (optional).
*
* If set, the provided extention callback is called whenever
* a certificate is parsed. For more information, please see
* the documentation of
* \c mbedtls_x509_crt_parse_der_with_ext_cb().
*
* \param ssl The SSL context to use.
* \param f_ext The extentions callback to use during CRT parsing.
* \param p_ext The opaque context to be passed to the callback.
*/
void mbedtls_ssl_set_ext_cb(mbedtls_ssl_context *ssl, mbedtls_x509_crt_ext_cb_t f_ext, void *p_ext);
#endif /* MBEDTLS_X509_CRT_PARSE_C */
/**

38
library/ssl_tls.c
View File

@ -1472,6 +1472,12 @@ void mbedtls_ssl_conf_verify(mbedtls_ssl_config *conf,
conf->f_vrfy = f_vrfy;
conf->p_vrfy = p_vrfy;
}
void mbedtls_ssl_conf_ext_cb(mbedtls_ssl_config *conf, mbedtls_x509_crt_ext_cb_t f_ext, void *p_ext)
{
conf->f_ext = f_ext;
conf->p_ext = p_ext;
}
#endif /* MBEDTLS_X509_CRT_PARSE_C */
void mbedtls_ssl_conf_dbg(mbedtls_ssl_config *conf,
@ -1754,6 +1760,12 @@ void mbedtls_ssl_set_verify(mbedtls_ssl_context *ssl,
ssl->f_vrfy = f_vrfy;
ssl->p_vrfy = p_vrfy;
}
void mbedtls_ssl_set_ext_cb(mbedtls_ssl_context *ssl, mbedtls_x509_crt_ext_cb_t f_ext, void *p_ext)
{
ssl->f_ext = f_ext;
ssl->p_ext = p_ext;
}
#endif
#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
@ -6946,12 +6958,30 @@ static int ssl_parse_certificate_chain(mbedtls_ssl_context *ssl,
/* Parse the next certificate in the chain. */
#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
ret = mbedtls_x509_crt_parse_der(chain, ssl->in_msg + i, n);
enum { COPY_CRT = 1 };
#else
/* If we don't need to store the CRT chain permanently, parse
* it in-place from the input buffer instead of making a copy. */
ret = mbedtls_x509_crt_parse_der_nocopy(chain, ssl->in_msg + i, n);
enum { COPY_CRT = 0 };
#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
mbedtls_x509_crt_ext_cb_t f_ext;
void *p_ext;
if (ssl->f_ext != NULL) {
MBEDTLS_SSL_DEBUG_MSG(3, ("Use context-specific extension callback"));
f_ext = ssl->f_ext;
p_ext = ssl->p_ext;
} else {
MBEDTLS_SSL_DEBUG_MSG(3, ("Use configuration-specific extension callback"));
f_ext = ssl->conf->f_ext;
p_ext = ssl->conf->p_ext;
}
ret = mbedtls_x509_crt_parse_der_with_ext_cb(chain,
ssl->in_msg + i,
n,
COPY_CRT,
f_ext,
p_ext);
switch (ret) {
case 0: /*ok*/
case MBEDTLS_ERR_X509_UNKNOWN_OID: