feedc0de/wolfssl
1
0
Fork 0
forked from wolfSSL/wolfssl
Code Pull Requests Activity

additional fix for set verify depth to be compliant with openssl limit

Browse Source
This commit is contained in:
Hideki Miyazaki
2021-05-19 13:10:10 +09:00
parent 258e0c10da
commit ddf2a0227f
2 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
src/internal.c
View File

@ -12397,7 +12397,8 @@ int ProcessPeerCerts(WOLFSSL* ssl, byte* input, word32* inOutIdx,
} }
#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL) #if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
if (args->untrustedDepth > ssl->options.verifyDepth) { /* limit compliant with OpenSSL verify Depth + 1 */
if (args->untrustedDepth > (ssl->options.verifyDepth + 1)) {
ssl->peerVerifyRet = X509_V_ERR_CERT_CHAIN_TOO_LONG; ssl->peerVerifyRet = X509_V_ERR_CERT_CHAIN_TOO_LONG;
ret = MAX_CHAIN_ERROR; ret = MAX_CHAIN_ERROR;
} }

4
tests/api.c
View File

@ -4595,8 +4595,8 @@ static void test_wolfSSL_CTX_verifyDepth_ServerClient(void)
client_args.argc = -1; client_args.argc = -1;
test_client_verifyDepth(&client_args); test_client_verifyDepth(&client_args);
join_thread(serverThread); join_thread(serverThread);
AssertIntEQ(client_args.return_code, TEST_FAIL); AssertIntEQ(client_args.return_code, TEST_SUCCESS);
AssertIntEQ(server_args.return_code, TEST_FAIL); AssertIntEQ(server_args.return_code, TEST_SUCCESS);
} }
FreeTcpReady(&ready); FreeTcpReady(&ready);