generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Do not display a CT log error message if CT validation is disabled

Browse Source 
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
This commit is contained in:
Rob Percival
2016-03-04 19:06:43 +00:00
committed by Rich Salz
parent 60b350a3ef
commit 328f36c5c5
4 changed files with 14 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
apps/apps.c
View File

@@ -238,11 +238,7 @@ int ctx_set_verify_locations(SSL_CTX *ctx, const char *CAfile,
int ctx_set_ctlog_list_file(SSL_CTX *ctx, const char *path)
{
if (path == NULL) {
if (SSL_CTX_set_default_ctlog_list_file(ctx) <= 0) {
BIO_puts(bio_err, "Failed to load default Certificate Transparency "
"log list\n");
}
return 1; /* Do not treat failure to load the default as an error */
return SSL_CTX_set_default_ctlog_list_file(ctx);
}
return SSL_CTX_set_ctlog_list_file(ctx, path);

14
apps/s_client.c
View File

@@ -1670,8 +1670,18 @@ int s_client_main(int argc, char **argv)
}
if (!ctx_set_ctlog_list_file(ctx, ctlog_file)) {
ERR_print_errors(bio_err);
goto end;
if (ct_validation != NULL) {
ERR_print_errors(bio_err);
goto end;
}
/*
* If CT validation is not enabled, the log list isn't needed so don't
* show errors or abort. We try to load it regardless because then we
* can show the names of the logs any SCTs came from (SCTs may be seen
* even with validation disabled).
*/
ERR_clear_error();
}
#endif

3
doc/ssl/SSL_CTX_set_ctlog_list_file.pod
View File

@@ -37,9 +37,6 @@ The expected format of the log list file is:
These functions will not clear the existing CT log list - it will be appended
to.
SSL_CTX_set_default_ctlog_list_file() will not report errors if it fails for
any reason. Use SSL_CTX_set_ctlog_list_file() if you want errors to be reported.
If an error occurs whilst parsing a particular log entry in the file, that log
entry will be skipped.

6
ssl/ssl_lib.c
View File

@@ -4143,11 +4143,7 @@ end:
int SSL_CTX_set_default_ctlog_list_file(SSL_CTX *ctx)
{
int ret = CTLOG_STORE_load_default_file(ctx->ctlog_store);
/* Clear any errors if the default file does not exist */
ERR_clear_error();
return ret;
return CTLOG_STORE_load_default_file(ctx->ctlog_store);
}
int SSL_CTX_set_ctlog_list_file(SSL_CTX *ctx, const char *path)