blob: 7cb1d7958d0b8ac669197d59aaa31a62f18cbd6c (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
|
@deftypefun {int} {gnutls_certificate_verify_peers3} (gnutls_session_t @var{session}, const char * @var{hostname}, unsigned int * @var{status})
@var{session}: is a gnutls session
@var{hostname}: is the expected name of the peer; may be @code{NULL}
@var{status}: is the output of the verification
This function will verify the peer's certificate and store the
the status in the @code{status} variable as a bitwise OR of gnutls_certificate_status_t
values or zero if the certificate is trusted. Note that value in @code{status} is set only when the return value of this function is success (i.e, failure
to trust a certificate does not imply a negative return value).
The default verification flags used by this function can be overridden
using @code{gnutls_certificate_set_verify_flags()} . See the documentation
of @code{gnutls_certificate_verify_peers2()} for details in the verification process.
This function will take into account the stapled OCSP responses sent by the server,
as well as the following X.509 certificate extensions: Name Constraints,
Key Usage, and Basic Constraints (pathlen).
If the @code{hostname} provided is non-NULL then this function will compare
the hostname in the certificate against it. The comparison will follow
the RFC6125 recommendations. If names do not match the
@code{GNUTLS_CERT_UNEXPECTED_OWNER} status flag will be set.
In order to verify the purpose of the end-certificate (by checking the extended
key usage), use @code{gnutls_certificate_verify_peers()} .
To avoid denial of service attacks some
default upper limits regarding the certificate key size and chain
size are set. To override them use @code{gnutls_certificate_set_verify_limits()} .
Note that when using raw public-keys verification will not work because there is
no corresponding certificate body belonging to the raw key that can be verified. In that
case this function will return @code{GNUTLS_E_INVALID_REQUEST} .
@strong{Returns:} @code{GNUTLS_E_SUCCESS} (0) when the validation is performed, or a negative error code otherwise.
A successful error code means that the @code{status} parameter must be checked to obtain the validation status.
@strong{Since:} 3.1.4
@end deftypefun
|
