From 15dba5be6a4482a9ad7e5b846291f31e97e338ca Mon Sep 17 00:00:00 2001 From: Matt Caswell Date: Tue, 27 Jan 2015 10:35:27 +0000 Subject: [PATCH] Add flag to inhibit checking for alternate certificate chains. Setting this behaviour will force behaviour as per previous versions of OpenSSL Reviewed-by: Dr. Stephen Henson --- crypto/x509/x509_vfy.c | 6 ++++-- crypto/x509/x509_vfy.h | 6 ++++++ 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c index b986d4c643..bb6e1ce9af 100644 --- a/crypto/x509/x509_vfy.c +++ b/crypto/x509/x509_vfy.c @@ -357,11 +357,13 @@ int X509_verify_cert(X509_STORE_CTX *ctx) /* * If it's not explicitly trusted then check if there is an alternative * chain that could be used. We only do this if we haven't already - * checked via TRUSTED_FIRST + * checked via TRUSTED_FIRST and the user hasn't switched off alternate + * chain checking */ retry = 0; if (i != X509_TRUST_TRUSTED - && !(ctx->param->flags & X509_V_FLAG_TRUSTED_FIRST)) { + && !(ctx->param->flags & X509_V_FLAG_TRUSTED_FIRST) + && !(ctx->param->flags & X509_V_FLAG_NO_ALT_CHAINS)) { while (j-- > 1) { xtmp2 = sk_X509_value(ctx->chain, j - 1); ok = ctx->get_issuer(&xtmp, ctx, xtmp2); diff --git a/crypto/x509/x509_vfy.h b/crypto/x509/x509_vfy.h index 03e43e5869..e41b5e228b 100644 --- a/crypto/x509/x509_vfy.h +++ b/crypto/x509/x509_vfy.h @@ -419,6 +419,12 @@ void X509_STORE_CTX_set_depth(X509_STORE_CTX *ctx, int depth); # define X509_V_FLAG_SUITEB_128_LOS 0x30000 /* Allow partial chains if at least one certificate is in trusted store */ # define X509_V_FLAG_PARTIAL_CHAIN 0x80000 +/* + * If the initial chain is not trusted, do not attempt to build an alternative + * chain. Alternate chain checking was introduced in 1.1.0. Setting this flag + * will force the behaviour to match that of previous versions. + */ +# define X509_V_FLAG_NO_ALT_CHAINS 0x100000 # define X509_VP_FLAG_DEFAULT 0x1 # define X509_VP_FLAG_OVERWRITE 0x2 -- 2.25.1