diff options
| author | Dr. Stephen Henson <steve@openssl.org> | 2003-02-12 20:05:17 +0300 |
|---|---|---|
| committer | Dr. Stephen Henson <steve@openssl.org> | 2003-02-12 20:05:17 +0300 |
| commit | c13eba970c7d2c1ca1695d1df8b2419368cf82f8 (patch) | |
| tree | 91ed73bcfd47677c63cb93844a8f89055dbb4bd8 /ssl | |
| parent | 4309b740ce381605f7145a19f44d0e0423fd70e2 (diff) | |
Option to disable auto SSL chain building.
Diffstat (limited to 'ssl')
| -rw-r--r-- | ssl/s3_both.c | 17 | ||||
| -rw-r--r-- | ssl/ssl.h | 2 |
2 files changed, 16 insertions, 3 deletions
diff --git a/ssl/s3_both.c b/ssl/s3_both.c index 38a7152814..64d317b7ac 100644 --- a/ssl/s3_both.c +++ b/ssl/s3_both.c @@ -268,6 +268,13 @@ unsigned long ssl3_output_cert_chain(SSL *s, X509 *x) X509_STORE_CTX xs_ctx; X509_OBJECT obj; + int no_chain; + + if ((s->mode & SSL_MODE_NO_AUTO_CHAIN) || s->ctx->extra_certs) + no_chain = 1; + else + no_chain = 0; + /* TLSv1 sends a chain with nothing in it, instead of an alert */ buf=s->init_buf; if (!BUF_MEM_grow_clean(buf,10)) @@ -277,7 +284,7 @@ unsigned long ssl3_output_cert_chain(SSL *s, X509 *x) } if (x != NULL) { - if(!X509_STORE_CTX_init(&xs_ctx,s->ctx->cert_store,NULL,NULL)) + if(!no_chain && !X509_STORE_CTX_init(&xs_ctx,s->ctx->cert_store,NULL,NULL)) { SSLerr(SSL_F_SSL3_OUTPUT_CERT_CHAIN,ERR_R_X509_LIB); return(0); @@ -295,6 +302,10 @@ unsigned long ssl3_output_cert_chain(SSL *s, X509 *x) l2n3(n,p); i2d_X509(x,&p); l+=n+3; + + if (no_chain) + break; + if (X509_NAME_cmp(X509_get_subject_name(x), X509_get_issuer_name(x)) == 0) break; @@ -306,8 +317,8 @@ unsigned long ssl3_output_cert_chain(SSL *s, X509 *x) * ref count */ X509_free(x); } - - X509_STORE_CTX_cleanup(&xs_ctx); + if (!no_chain) + X509_STORE_CTX_cleanup(&xs_ctx); } /* Thawte special :-) */ @@ -521,6 +521,8 @@ typedef struct ssl_session_st /* Never bother the application with retries if the transport * is blocking: */ #define SSL_MODE_AUTO_RETRY 0x00000004L +/* Don't attempt to automatically build certificate chain */ +#define SSL_MODE_NO_AUTO_CHAIN 0x00000008L /* Note: SSL[_CTX]_set_{options,mode} use |= op on the previous value, |