mirrors/openssl
0
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2024-12-17 22:13:45 +08:00
Code Issues Packages Projects Releases Wiki Activity

Make it possible to check for explicit auxiliary trust

Browse Source 
By default X509_check_trust() trusts self-signed certificates from
the trust store that have no explicit local trust/reject oids
encapsulated as a "TRUSTED CERTIFICATE" object.  (See the -addtrust
and -trustout options of x509(1)).

This commit adds a flag that makes it possible to distinguish between
that implicit trust, and explicit auxiliary settings.

With flags |= X509_TRUST_NO_SS_COMPAT, a certificate is only trusted
via explicit trust settings.

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
This commit is contained in:
Viktor Dukhovni 2016-01-27 22:43:23 -05:00
parent d8ca44ba41
commit aea6116146
2 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
crypto/x509/x509_trs.c
View File

@ -285,7 +285,7 @@ static int trust_compat(X509_TRUST *trust, X509 *x, int flags)
{
/* Call for side-effect of computing hash and caching extensions */
X509_check_purpose(x, -1, 0);
if (x->ex_flags & EXFLAG_SS)
if ((flags & X509_TRUST_NO_SS_COMPAT) == 0 && x->ex_flags & EXFLAG_SS)
return X509_TRUST_TRUSTED;
else
return X509_TRUST_UNTRUSTED;

5
include/openssl/x509.h
View File

@ -199,8 +199,9 @@ DEFINE_STACK_OF(X509_TRUST)
# define X509_TRUST_MAX 8
/* trust_flags values */
# define X509_TRUST_DYNAMIC 1
# define X509_TRUST_DYNAMIC_NAME 2
# define X509_TRUST_DYNAMIC (1U << 0)
# define X509_TRUST_DYNAMIC_NAME (1U << 1)
# define X509_TRUST_NO_SS_COMPAT (1U << 2)
/* check_trust return codes */