diff options
| author | Dr. Stephen Henson <steve@openssl.org> | 2014-03-27 14:20:16 +0000 |
|---|---|---|
| committer | Dr. Stephen Henson <steve@openssl.org> | 2014-03-27 14:24:40 +0000 |
| commit | e970f63dc028e32df50fa7135e5e0334afa24d83 (patch) | |
| tree | e3a3465657051ce151207a138d77a789d8b11a07 /ssl/ssl_cert.c | |
| parent | 7c5718be271d9a47e8538adfde1909cd58943244 (diff) | |
Update chain building function.
Don't clear verification errors from the error queue unless
SSL_BUILD_CHAIN_FLAG_CLEAR_ERROR is set.
If errors occur during verification and SSL_BUILD_CHAIN_FLAG_IGNORE_ERROR
is set return 2 so applications can issue warnings.
(cherry picked from commit 2dd6976f6d02f98b30c376951ac38f780a86b3b5)
Diffstat (limited to 'ssl/ssl_cert.c')
| -rw-r--r-- | ssl/ssl_cert.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/ssl/ssl_cert.c b/ssl/ssl_cert.c index 09ea611d8a..3ad0f8bca3 100644 --- a/ssl/ssl_cert.c +++ b/ssl/ssl_cert.c @@ -1247,8 +1247,10 @@ int ssl_build_cert_chain(CERT *c, X509_STORE *chain_store, int flags) i = X509_verify_cert(&xs_ctx); if (i <= 0 && flags & SSL_BUILD_CHAIN_FLAG_IGNORE_ERROR) { - ERR_clear_error(); + if (flags & SSL_BUILD_CHAIN_FLAG_CLEAR_ERROR) + ERR_clear_error(); i = 1; + rv = 2; } if (i > 0) chain = X509_STORE_CTX_get1_chain(&xs_ctx); @@ -1283,7 +1285,8 @@ int ssl_build_cert_chain(CERT *c, X509_STORE *chain_store, int flags) } } cpk->chain = chain; - rv = 1; + if (rv == 0) + rv = 1; err: if (flags & SSL_BUILD_CHAIN_FLAG_CHECK) X509_STORE_free(chain_store); |