generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Inherit parameters properly in SSL contexts: any parameters set should

Browse Source 
replace those in the current list.
This commit is contained in:
Dr. Stephen Henson 2009-06-30 11:21:00 +00:00
parent fa07f00aaf
commit 43ea53a04a
2 changed files with 11 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
crypto/x509/x509_vpm.c
View File

@ -199,8 +199,12 @@ int X509_VERIFY_PARAM_inherit(X509_VERIFY_PARAM *dest,
int X509_VERIFY_PARAM_set1(X509_VERIFY_PARAM *to, int X509_VERIFY_PARAM_set1(X509_VERIFY_PARAM *to,
const X509_VERIFY_PARAM *from) const X509_VERIFY_PARAM *from)
{ {
unsigned long save_flags = to->inh_flags;
int ret;
to->inh_flags |= X509_VP_FLAG_DEFAULT; to->inh_flags |= X509_VP_FLAG_DEFAULT;
return X509_VERIFY_PARAM_inherit(to, from); ret = X509_VERIFY_PARAM_inherit(to, from);
to->inh_flags = save_flags;
return ret;
} }
int X509_VERIFY_PARAM_set1_name(X509_VERIFY_PARAM *param, const char *name) int X509_VERIFY_PARAM_set1_name(X509_VERIFY_PARAM *param, const char *name)

9
ssl/ssl_cert.c
View File

@ -502,9 +502,6 @@ int ssl_verify_cert_chain(SSL *s,STACK_OF(X509) *sk)
SSLerr(SSL_F_SSL_VERIFY_CERT_CHAIN,ERR_R_X509_LIB); SSLerr(SSL_F_SSL_VERIFY_CERT_CHAIN,ERR_R_X509_LIB);
return(0); return(0);
} }
if (s->param)
X509_VERIFY_PARAM_inherit(X509_STORE_CTX_get0_param(&ctx),
s->param);
#if 0 #if 0
if (SSL_get_verify_depth(s) >= 0) if (SSL_get_verify_depth(s) >= 0)
X509_STORE_CTX_set_depth(&ctx, SSL_get_verify_depth(s)); X509_STORE_CTX_set_depth(&ctx, SSL_get_verify_depth(s));
@ -518,6 +515,12 @@ int ssl_verify_cert_chain(SSL *s,STACK_OF(X509) *sk)
X509_STORE_CTX_set_default(&ctx, X509_STORE_CTX_set_default(&ctx,
s->server ? "ssl_client" : "ssl_server"); s->server ? "ssl_client" : "ssl_server");
/* Anything non-default in "param" should overwrite anything in the
* ctx.
*/
if (s->param)
X509_VERIFY_PARAM_set1(X509_STORE_CTX_get0_param(&ctx),
s->param);
if (s->verify_callback) if (s->verify_callback)
X509_STORE_CTX_set_verify_cb(&ctx, s->verify_callback); X509_STORE_CTX_set_verify_cb(&ctx, s->verify_callback);