From c636c1c470fd2b4b0cb546e6ee85971375e42ec1 Mon Sep 17 00:00:00 2001 From: Viktor Dukhovni Date: Sat, 2 Apr 2016 16:47:48 -0400 Subject: Fix client verify mode to check SSL_VERIFY_PEER MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The original check for != SSL_VERIFY_NONE can give surprising results when flags SSL_VERIFY_PEER is not set, but other flags are. Note that SSL_VERIFY_NONE (0) is not a flag bit, it is rather the absense of all other flag bits. Signed-off-by: Rob Percival Reviewed-by: Emilia Käsper --- ssl/statem/statem_clnt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'ssl') diff --git a/ssl/statem/statem_clnt.c b/ssl/statem/statem_clnt.c index 4806e6782b..19ea227e6a 100644 --- a/ssl/statem/statem_clnt.c +++ b/ssl/statem/statem_clnt.c @@ -1334,7 +1334,7 @@ MSG_PROCESS_RETURN tls_process_server_certificate(SSL *s, PACKET *pkt) } i = ssl_verify_cert_chain(s, sk); - if (s->verify_mode != SSL_VERIFY_NONE && i <= 0) { + if ((s->verify_mode & SSL_VERIFY_PEER) && i <= 0) { al = ssl_verify_alarm_type(s->verify_result); SSLerr(SSL_F_TLS_PROCESS_SERVER_CERTIFICATE, SSL_R_CERTIFICATE_VERIFY_FAILED); -- cgit v1.2.3