From: Dr. Stephen Henson <steve@openssl.org>
Date: Thu, 20 Nov 2014 14:06:50 +0000 (+0000)
Subject: Fix SuiteB chain checking logic.
X-Git-Tag: OpenSSL_1_0_2-pre-reformat~115
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=8d325d1d36fb46c49cf7f36e7c181a7034474d32;p=openssl

Fix SuiteB chain checking logic.

Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit 7255ca99df1f2d83d99d113dd5ca54b88d50e72b)
---

diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c
index 8e802a2e3f..d02ae19d58 100644
--- a/ssl/t1_lib.c
+++ b/ssl/t1_lib.c
@@ -4240,13 +4240,10 @@ int tls1_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain,
 		if (check_flags)
 			check_flags |= CERT_PKEY_SUITEB;
 		ok = X509_chain_check_suiteb(NULL, x, chain, suiteb_flags);
-		if (ok != X509_V_OK)
-			{
-			if (check_flags)
-				rv |= CERT_PKEY_SUITEB;
-			else
-				goto end;
-			}
+		if (ok == X509_V_OK)
+			rv |= CERT_PKEY_SUITEB;
+		else if (!check_flags)
+			goto end;
 		}
 
 	/* Check all signature algorithms are consistent with