From: Dr. Stephen Henson <steve@openssl.org>
Date: Fri, 14 Feb 2014 15:07:01 +0000 (+0000)
Subject: Include TA in checks/callback with partial chains.
X-Git-Tag: master-pre-reformat~909
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=385b3486661628f3f806205752bf968b8114b347;p=thirdparty%2Fopenssl.git

Include TA in checks/callback with partial chains.

When a chain is complete and ends in a trusted root checks are also
performed on the TA and the callback notified with ok==1. For
consistency do the same for chains where the TA is not self signed.
---

diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c
index 8129fa084d1..869a4f29e85 100644
--- a/crypto/x509/x509_vfy.c
+++ b/crypto/x509/x509_vfy.c
@@ -1755,7 +1755,7 @@ static int internal_verify(X509_STORE_CTX *ctx)
 		xs=xi;
 	else
 		{
-		if (ctx->param->flags & X509_V_FLAG_PARTIAL_CHAIN && n == 0)
+		if (ctx->param->flags & X509_V_FLAG_PARTIAL_CHAIN)
 			{
 			xs = xi;
 			goto check_cert;