From db28aa86e00b9121bee94d1e65506bf22d5ca6e3 Mon Sep 17 00:00:00 2001 From: "Dr. Stephen Henson" Date: Thu, 25 Feb 2010 12:21:48 +0000 Subject: add -trusted_first option and verify flag --- crypto/x509/x509_vfy.c | 15 +++++++++++++++ crypto/x509/x509_vfy.h | 2 ++ 2 files changed, 17 insertions(+) (limited to 'crypto') diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c index 70011fd733..7bac3c6f24 100644 --- a/crypto/x509/x509_vfy.c +++ b/crypto/x509/x509_vfy.c @@ -215,6 +215,21 @@ int X509_verify_cert(X509_STORE_CTX *ctx) /* If we are self signed, we break */ if (cert_self_signed(x)) break; + /* If asked see if we can find issuer in trusted store first */ + if (ctx->param->flags & X509_V_FLAG_TRUSTED_FIRST) + { + ok = ctx->get_issuer(&xtmp, ctx, x); + if (ok < 0) + return ok; + /* If successful for now free up cert so it + * will be picked up again later. + */ + if (ok > 0) + { + X509_free(xtmp); + break; + } + } /* If we were passed a cert chain, use it first */ if (ctx->untrusted != NULL) diff --git a/crypto/x509/x509_vfy.h b/crypto/x509/x509_vfy.h index 5a8276dead..992005f222 100644 --- a/crypto/x509/x509_vfy.h +++ b/crypto/x509/x509_vfy.h @@ -389,6 +389,8 @@ void X509_STORE_CTX_set_depth(X509_STORE_CTX *ctx, int depth); #define X509_V_FLAG_USE_DELTAS 0x2000 /* Check selfsigned CA signature */ #define X509_V_FLAG_CHECK_SS_SIGNATURE 0x4000 +/* Use trusted store first */ +#define X509_V_FLAG_TRUSTED_FIRST 0x8000 #define X509_VP_FLAG_DEFAULT 0x1 -- cgit v1.2.3