Since there's no continuation, the ; can go as well :-)

[oweals/openssl.git] / apps / verify.c

diff --git a/apps/verify.c b/apps/verify.c
index 60da5c5a249d445838fd097907f7e0f8b97a852b..215ef84fc75f5347e3ee530328f3fc9fedec8bf8 100644 (file)
--- a/apps/verify.c
+++ b/apps/verify.c
@@ -65,7 +65,6 @@
 #include <openssl/x509.h>
 #include <openssl/x509v3.h>
 #include <openssl/pem.h>
-#include <openssl/engine.h>
 
 #undef PROG
 #define PROG   verify_main
@@ -101,6 +100,9 @@ int MAIN(int argc, char **argv)
                if ((bio_err=BIO_new(BIO_s_file())) != NULL)
                        BIO_set_fp(bio_err,stderr,BIO_NOCLOSE|BIO_FP_TEXT);
 
+       if (!load_config(bio_err, NULL))
+               goto end;
+
        argc--;
        argv++;
        for (;;)
@@ -147,6 +149,8 @@ int MAIN(int argc, char **argv)
                                }
                        else if (strcmp(*argv,"-help") == 0)
                                goto end;
+                       else if (strcmp(*argv,"-ignore_critical") == 0)
+                               vflags |= X509_V_FLAG_IGNORE_CRITICAL;
                        else if (strcmp(*argv,"-issuer_checks") == 0)
                                vflags |= X509_V_FLAG_CB_ISSUER_CHECK;
                        else if (strcmp(*argv,"-crl_check") == 0)
@@ -249,7 +253,11 @@ static int check(X509_STORE *ctx, char *file, STACK_OF(X509) *uchain, STACK_OF(X
                goto end;
                }
        X509_STORE_set_flags(ctx, vflags);
-       X509_STORE_CTX_init(csc,ctx,x,uchain);
+       if(!X509_STORE_CTX_init(csc,ctx,x,uchain))
+               {
+               ERR_print_errors(bio_err);
+               goto end;
+               }
        if(tchain) X509_STORE_CTX_trusted_stack(csc, tchain);
        if(purpose >= 0) X509_STORE_CTX_set_purpose(csc, purpose);
        i=X509_verify_cert(csc);
@@ -340,6 +348,7 @@ static int MS_CALLBACK cb(int ok, X509_STORE_CTX *ctx)
                if (ctx->error == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT) ok=1;
                if (ctx->error == X509_V_ERR_CRL_HAS_EXPIRED) ok=1;
                if (ctx->error == X509_V_ERR_CRL_NOT_YET_VALID) ok=1;
+               if (ctx->error == X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION) ok=1;
                }
        if (!v_verbose)
                ERR_clear_error();