diff options
| author | Dr. Stephen Henson <steve@openssl.org> | 2010-02-25 12:21:48 +0000 |
|---|---|---|
| committer | Dr. Stephen Henson <steve@openssl.org> | 2010-02-25 12:21:48 +0000 |
| commit | db28aa86e00b9121bee94d1e65506bf22d5ca6e3 (patch) | |
| tree | ffda33fe5c02e8d50223ecc29229b0c7b189dc26 /crypto | |
| parent | 2da2ff50650c8e372f7a0e0bc8d0091bc230517d (diff) | |
add -trusted_first option and verify flag
Diffstat (limited to 'crypto')
| -rw-r--r-- | crypto/x509/x509_vfy.c | 15 | ||||
| -rw-r--r-- | crypto/x509/x509_vfy.h | 2 |
2 files changed, 17 insertions, 0 deletions
diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c index 70011fd733..7bac3c6f24 100644 --- a/crypto/x509/x509_vfy.c +++ b/crypto/x509/x509_vfy.c @@ -215,6 +215,21 @@ int X509_verify_cert(X509_STORE_CTX *ctx) /* If we are self signed, we break */ if (cert_self_signed(x)) break; + /* If asked see if we can find issuer in trusted store first */ + if (ctx->param->flags & X509_V_FLAG_TRUSTED_FIRST) + { + ok = ctx->get_issuer(&xtmp, ctx, x); + if (ok < 0) + return ok; + /* If successful for now free up cert so it + * will be picked up again later. + */ + if (ok > 0) + { + X509_free(xtmp); + break; + } + } /* If we were passed a cert chain, use it first */ if (ctx->untrusted != NULL) diff --git a/crypto/x509/x509_vfy.h b/crypto/x509/x509_vfy.h index 5a8276dead..992005f222 100644 --- a/crypto/x509/x509_vfy.h +++ b/crypto/x509/x509_vfy.h @@ -389,6 +389,8 @@ void X509_STORE_CTX_set_depth(X509_STORE_CTX *ctx, int depth); #define X509_V_FLAG_USE_DELTAS 0x2000 /* Check selfsigned CA signature */ #define X509_V_FLAG_CHECK_SS_SIGNATURE 0x4000 +/* Use trusted store first */ +#define X509_V_FLAG_TRUSTED_FIRST 0x8000 #define X509_VP_FLAG_DEFAULT 0x1 |