File openssl-1.0.2a-alternate-certificate-validation... of Package mingw32-openssl

Overview Repositories Revisions Requests Users Attributes Meta

File openssl-1.0.2a-alternate-certificate-validation-switch.patch of Package mingw32-openssl (Revision d9819ace0d827be6363b3a7043126bfd)

Currently displaying revision d9819ace0d827be6363b3a7043126bfd , Show latest

From 15dba5be6a4482a9ad7e5b846291f31e97e338ca Mon Sep 17 00:00:00 2001
From: Matt Caswell <matt@openssl.org>
Date: Tue, 27 Jan 2015 10:35:27 +0000
Subject: [PATCH] Add flag to inhibit checking for alternate certificate
 chains. Setting this behaviour will force behaviour as per previous versions
 of OpenSSL

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
---
 crypto/x509/x509_vfy.c | 6 ++++--
 crypto/x509/x509_vfy.h | 6 ++++++
 2 files changed, 10 insertions(+), 2 deletions(-)

--- a/crypto/x509/x509_vfy.c
+++ b/crypto/x509/x509_vfy.c
@@ -364,3 +364,4 @@ int X509_verify_cert(X509_STORE_CTX *ctx
          * chain that could be used. We only do this if we haven't already
-         * checked via TRUSTED_FIRST
+         * checked via TRUSTED_FIRST and the user hasn't switched off alternate
+         * chain checking
          */
@@ -368,3 +369,4 @@ int X509_verify_cert(X509_STORE_CTX *ctx
         if (i != X509_TRUST_TRUSTED
-            && !(ctx->param->flags & X509_V_FLAG_TRUSTED_FIRST)) {
+            && !(ctx->param->flags & X509_V_FLAG_TRUSTED_FIRST)
+            && !(ctx->param->flags & X509_V_FLAG_NO_ALT_CHAINS)) {
             while (j-- > 1) {
--- a/crypto/x509/x509_vfy.h
+++ b/crypto/x509/x509_vfy.h
@@ -434,2 +434,8 @@ void X509_STORE_CTX_set_depth(X509_STORE
 # define X509_V_FLAG_PARTIAL_CHAIN               0x80000
+/*
+ * If the initial chain is not trusted, do not attempt to build an alternative
+ * chain. Alternate chain checking was introduced in 1.1.0. Setting this flag
+ * will force the behaviour to match that of previous versions.
+ */
+# define X509_V_FLAG_NO_ALT_CHAINS               0x100000

Places

File openssl-1.0.2a-alternate-certificate-validation-switch.patch of Package mingw32-openssl (Revision d9819ace0d827be6363b3a7043126bfd)

Places