diff options
| author | Bob Beck <beck@cvs.openbsd.org> | 2021-08-18 15:32:39 +0000 |
|---|---|---|
| committer | Bob Beck <beck@cvs.openbsd.org> | 2021-08-18 15:32:39 +0000 |
| commit | c7c9c07158804f2b44ac88583b62314f2e34d38b (patch) | |
| tree | 25a96a09de0436324c91a2b37130c90c5a840ce7 /lib | |
| parent | d986e0034c9dd6683596f4cb2816a35effb42f2f (diff) | |
Add a check_trust call to the legacy chain validation on chain add, remembering
the result in order to return the same errors as OpenSSL users expect to override
the generic "Untrusted cert" error.
This fixes the openssl-ruby timestamp test.
ok tb@
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/libcrypto/x509/x509_verify.c | 12 |
1 files changed, 10 insertions, 2 deletions
diff --git a/lib/libcrypto/x509/x509_verify.c b/lib/libcrypto/x509/x509_verify.c index dd053ad8122..9073dda31d0 100644 --- a/lib/libcrypto/x509/x509_verify.c +++ b/lib/libcrypto/x509/x509_verify.c @@ -1,4 +1,4 @@ -/* $OpenBSD: x509_verify.c,v 1.40 2021/08/18 15:10:46 beck Exp $ */ +/* $OpenBSD: x509_verify.c,v 1.41 2021/08/18 15:32:38 beck Exp $ */ /* * Copyright (c) 2020-2021 Bob Beck <beck@openbsd.org> * @@ -312,7 +312,7 @@ static int x509_verify_ctx_validate_legacy_chain(struct x509_verify_ctx *ctx, struct x509_verify_chain *chain, size_t depth) { - int ret = 0; + int ret = 0, trust; if (ctx->xsc == NULL) return 1; @@ -330,6 +330,10 @@ x509_verify_ctx_validate_legacy_chain(struct x509_verify_ctx *ctx, ctx->xsc->error = X509_V_OK; ctx->xsc->error_depth = 0; + trust = x509_vfy_check_trust(ctx->xsc); + if (trust == X509_TRUST_REJECTED) + goto err; + if (!x509_verify_ctx_set_xsc_chain(ctx, chain, 0, 1)) goto err; @@ -354,6 +358,10 @@ x509_verify_ctx_validate_legacy_chain(struct x509_verify_ctx *ctx, if (!x509_vfy_check_policy(ctx->xsc)) goto err; + if ((!(ctx->xsc->param->flags & X509_V_FLAG_PARTIAL_CHAIN)) && + trust != X509_TRUST_TRUSTED) + goto err; + ret = 1; err: |