diff options
author | Dr. Stephen Henson <steve@openssl.org> | 2012-09-26 13:50:42 +0000 |
---|---|---|
committer | Dr. Stephen Henson <steve@openssl.org> | 2012-09-26 13:50:42 +0000 |
commit | 9d2006d8ed733522014035ec0514e23a312083e8 (patch) | |
tree | da40b3717b971ab0aa2b1b3d04eb236e1b0cb8b6 /crypto/x509 | |
parent | abf1e32f2f5f3edd0aab8dc294b548ec610fb33c (diff) |
add -trusted_first option and verify flag (backport from HEAD)
Diffstat (limited to 'crypto/x509')
-rw-r--r-- | crypto/x509/x509_vfy.c | 16 | ||||
-rw-r--r-- | crypto/x509/x509_vfy.h | 2 |
2 files changed, 18 insertions, 0 deletions
diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c index b0779db023..ba10811f80 100644 --- a/crypto/x509/x509_vfy.c +++ b/crypto/x509/x509_vfy.c @@ -206,6 +206,22 @@ int X509_verify_cert(X509_STORE_CTX *ctx) /* If we are self signed, we break */ if (ctx->check_issued(ctx, x,x)) break; + /* If asked see if we can find issuer in trusted store first */ + if (ctx->param->flags & X509_V_FLAG_TRUSTED_FIRST) + { + ok = ctx->get_issuer(&xtmp, ctx, x); + if (ok < 0) + return ok; + /* If successful for now free up cert so it + * will be picked up again later. + */ + if (ok > 0) + { + X509_free(xtmp); + break; + } + } + /* If we were passed a cert chain, use it first */ if (ctx->untrusted != NULL) { diff --git a/crypto/x509/x509_vfy.h b/crypto/x509/x509_vfy.h index fe09b30aaa..d53f3e3869 100644 --- a/crypto/x509/x509_vfy.h +++ b/crypto/x509/x509_vfy.h @@ -389,6 +389,8 @@ void X509_STORE_CTX_set_depth(X509_STORE_CTX *ctx, int depth); #define X509_V_FLAG_USE_DELTAS 0x2000 /* Check selfsigned CA signature */ #define X509_V_FLAG_CHECK_SS_SIGNATURE 0x4000 +/* Use trusted store first */ +#define X509_V_FLAG_TRUSTED_FIRST 0x8000 #define X509_VP_FLAG_DEFAULT 0x1 |