generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Check chain is not NULL before assuming we have a validated chain. The

Browse Source 
modification to the OCSP helper purpose breaks normal OCSP verification. It is
no longer needed now we can trust partial chains.
This commit is contained in:
Dr. Stephen Henson 2012-12-19 15:01:32 +00:00
parent f8cab37bc1
commit 54a0076e94
2 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
crypto/ocsp/ocsp_vfy.c
View File

@ -109,7 +109,7 @@ int OCSP_basic_verify(OCSP_BASICRESP *bs, STACK_OF(X509) *certs,
* (If the signer is a root certificate, X509_verify_cert()
* would fail anyway!)
*/
if (chain == certs) goto verified_chain;
if (chain && chain == certs) goto verified_chain;
/* If we trust some "other" certificates, allow partial
* chains (because some of them might be

2
crypto/x509v3/v3_purp.c
View File

@ -87,7 +87,7 @@ static X509_PURPOSE xstandard[] = {
{X509_PURPOSE_SMIME_ENCRYPT, X509_TRUST_EMAIL, 0, check_purpose_smime_encrypt, "S/MIME encryption", "smimeencrypt", NULL},
{X509_PURPOSE_CRL_SIGN, X509_TRUST_COMPAT, 0, check_purpose_crl_sign, "CRL signing", "crlsign", NULL},
{X509_PURPOSE_ANY, X509_TRUST_DEFAULT, 0, no_check, "Any Purpose", "any", NULL},
{X509_PURPOSE_OCSP_HELPER, X509_TRUST_OCSP_SIGN, 0, ocsp_helper, "OCSP helper", "ocsphelper", NULL},
{X509_PURPOSE_OCSP_HELPER, X509_TRUST_COMPAT, 0, ocsp_helper, "OCSP helper", "ocsphelper", NULL},
{X509_PURPOSE_TIMESTAMP_SIGN, X509_TRUST_TSA, 0, check_purpose_timestamp_sign, "Time Stamp signing", "timestampsign", NULL},
};