generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

tidy verify code. xn not used any more and check for self signed more efficiently

Browse Source
This commit is contained in:
Dr. Stephen Henson 2010-02-25 11:18:26 +00:00
parent fbd2164044
commit 2da2ff5065
1 changed files with 14 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
crypto/x509/x509_vfy.c
View File

@ -149,11 +149,19 @@ static int x509_subject_cmp(X509 **a, X509 **b)
return X509_subject_name_cmp(*a,*b); return X509_subject_name_cmp(*a,*b);
} }
#endif #endif
/* Return 1 is a certificate is self signed */
static int cert_self_signed(X509 *x)
{
X509_check_purpose(x, -1, 0);
if (x->ex_flags & EXFLAG_SS)
return 1;
else
return 0;
}
int X509_verify_cert(X509_STORE_CTX *ctx) int X509_verify_cert(X509_STORE_CTX *ctx)
{ {
X509 *x,*xtmp,*chain_ss=NULL; X509 *x,*xtmp,*chain_ss=NULL;
X509_NAME *xn;
int bad_chain = 0; int bad_chain = 0;
X509_VERIFY_PARAM *param = ctx->param; X509_VERIFY_PARAM *param = ctx->param;
int depth,i,ok=0; int depth,i,ok=0;
@ -205,8 +213,8 @@ int X509_verify_cert(X509_STORE_CTX *ctx)
*/ */
/* If we are self signed, we break */ /* If we are self signed, we break */
xn=X509_get_issuer_name(x); if (cert_self_signed(x))
if (ctx->check_issued(ctx, x,x)) break; break;
/* If we were passed a cert chain, use it first */ /* If we were passed a cert chain, use it first */
if (ctx->untrusted != NULL) if (ctx->untrusted != NULL)
@ -242,8 +250,7 @@ int X509_verify_cert(X509_STORE_CTX *ctx)
i=sk_X509_num(ctx->chain); i=sk_X509_num(ctx->chain);
x=sk_X509_value(ctx->chain,i-1); x=sk_X509_value(ctx->chain,i-1);
xn = X509_get_subject_name(x); if (cert_self_signed(x))
if (ctx->check_issued(ctx, x, x))
{ {
/* we have a self signed certificate */ /* we have a self signed certificate */
if (sk_X509_num(ctx->chain) == 1) if (sk_X509_num(ctx->chain) == 1)
@ -291,8 +298,8 @@ int X509_verify_cert(X509_STORE_CTX *ctx)
if (depth < num) break; if (depth < num) break;
/* If we are self signed, we break */ /* If we are self signed, we break */
xn=X509_get_issuer_name(x); if (cert_self_signed(x))
if (ctx->check_issued(ctx,x,x)) break; break;
ok = ctx->get_issuer(&xtmp, ctx, x); ok = ctx->get_issuer(&xtmp, ctx, x);
@ -310,7 +317,6 @@ int X509_verify_cert(X509_STORE_CTX *ctx)
} }
/* we now have our chain, lets check it... */ /* we now have our chain, lets check it... */
xn=X509_get_issuer_name(x);
i = check_trust(ctx); i = check_trust(ctx);