SwitchEmu/mbedtls
1
0
Fork 0
mirror of https://git.suyu.dev/suyu/mbedtls.git synced 2026-03-24 03:52:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add tests for profile enforcement

Browse Source 
Now all checks related to profile are covered in:
- verify_with_profile()
- verify_child()
- verify_top()
(that's 10 lines that were previously not covered)

Leaving aside profile enforcement in CRLs for now, as the focus is on
preparing to refactor cert verification.
This commit is contained in:
Manuel Pégourié-Gonnard
2017-05-23 11:29:29 +02:00
parent 9832ceaa2a
commit 6622fed524
2 changed files with 46 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
tests/suites/test_suite_x509parse.function
View File

@@ -28,6 +28,24 @@ const mbedtls_x509_crt_profile compat_profile =
1024,
};
const mbedtls_x509_crt_profile profile_rsa3072 =
{
MBEDTLS_X509_ID_FLAG( MBEDTLS_MD_SHA256 ) |
MBEDTLS_X509_ID_FLAG( MBEDTLS_MD_SHA384 ) |
MBEDTLS_X509_ID_FLAG( MBEDTLS_MD_SHA512 ),
MBEDTLS_X509_ID_FLAG( MBEDTLS_PK_RSA ),
0,
3072,
};
const mbedtls_x509_crt_profile profile_sha512 =
{
MBEDTLS_X509_ID_FLAG( MBEDTLS_MD_SHA512 ),
0xFFFFFFF, /* Any PK alg */
0xFFFFFFF, /* Any curve */
1024,
};
int verify_none( void *data, mbedtls_x509_crt *crt, int certificate_depth, uint32_t *flags )
{
((void) data);
@@ -569,6 +587,10 @@ void mbedtls_x509_crt_verify_chain( char *chain_paths, char *trusted_ca,
profile = &mbedtls_x509_crt_profile_next;
else if( strcmp(profile_name, "suiteb") == 0 )
profile = &mbedtls_x509_crt_profile_suiteb;
else if( strcmp(profile_name, "rsa3072") == 0 )
profile = &profile_rsa3072;
else if( strcmp(profile_name, "sha512") == 0 )
profile = &profile_sha512;
res = mbedtls_x509_crt_verify_with_profile( &chain, &trusted, NULL, profile,
NULL, &flags, NULL, NULL );