Add new "valid_flags" field to CERT_PKEY structure which determines what
the certificate can be used for (if anything). Set valid_flags field
in new tls1_check_chain function. Simplify ssl_set_cert_masks which used
to have similar checks in it.
Add new "cert_flags" field to CERT structure and include a "strict mode".
This enforces some TLS certificate requirements (such as only permitting
certificate signature algorithms contained in the supported algorithms
extension) which some implementations ignore: this option should be used
with caution as it could cause interoperability issues.
diff --git a/ssl/ssl_cert.c b/ssl/ssl_cert.c
index 9d9b604..89a5131 100644
--- a/ssl/ssl_cert.c
+++ b/ssl/ssl_cert.c
@@ -334,6 +334,7 @@
CRYPTO_add(&x->references, 1, CRYPTO_LOCK_X509);
}
}
+ rpk->valid_flags = 0;
if (cert->pkeys[i].authz != NULL)
{
/* Just copy everything. */
@@ -376,6 +377,8 @@
/* Shared sigalgs also NULL */
ret->shared_sigalgs = NULL;
+ ret->cert_flags = cert->cert_flags;
+
return(ret);
#if !defined(OPENSSL_NO_DH) || !defined(OPENSSL_NO_ECDH)
@@ -428,6 +431,7 @@
if (cpk->authz != NULL)
OPENSSL_free(cpk->authz);
#endif
+ cpk->valid_flags = 0;
}
}
