generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Partial path fix.

Browse Source 
When verifying a partial path always check to see if the EE certificate
is explicitly trusted: the path could contain other untrusted certificates.
This commit is contained in:
Dr. Stephen Henson 2013-09-08 19:26:59 +01:00
parent a6e7d1c0e3
commit 52073b7675
1 changed files with 8 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
crypto/x509/x509_vfy.c
View File

@ -787,11 +787,9 @@ static int check_trust(X509_STORE_CTX *ctx)
*/
if (ctx->param->flags & X509_V_FLAG_PARTIAL_CHAIN)
{
X509 *mx;
if (ctx->last_untrusted < sk_X509_num(ctx->chain))
return X509_TRUST_TRUSTED;
if (sk_X509_num(ctx->chain) == 1)
{
X509 *mx;
x = sk_X509_value(ctx->chain, 0);
mx = lookup_cert_match(ctx, x);
if (mx)
@ -802,7 +800,6 @@ static int check_trust(X509_STORE_CTX *ctx)
return X509_TRUST_TRUSTED;
}
}
}
/* If no trusted certs in chain at all return untrusted and
* allow standard (no issuer cert) etc errors to be indicated.