diff options
Diffstat (limited to 'src/crypto/x509/verify.go')
-rw-r--r-- | src/crypto/x509/verify.go | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/src/crypto/x509/verify.go b/src/crypto/x509/verify.go index 1193a266a9..999cb08cf3 100644 --- a/src/crypto/x509/verify.go +++ b/src/crypto/x509/verify.go @@ -156,6 +156,11 @@ type VerifyOptions struct { // constraint down the chain which mirrors Windows CryptoAPI behavior, // but not the spec. To accept any key usage, include ExtKeyUsageAny. KeyUsages []ExtKeyUsage + + // IsBoring is a validity check for BoringCrypto. + // If not nil, it will be called to check whether a given certificate + // can be used for constructing verification chains. + IsBoring func(*Certificate) bool } const ( @@ -258,6 +263,13 @@ func (c *Certificate) isValid(certType int, currentChain []*Certificate, opts *V } } + if opts.IsBoring != nil && !opts.IsBoring(c) { + // IncompatibleUsage is not quite right here, + // but it's also the "no chains found" error + // and is close enough. + return CertificateInvalidError{c, IncompatibleUsage} + } + return nil } |