From 8d325d1d36fb46c49cf7f36e7c181a7034474d32 Mon Sep 17 00:00:00 2001 From: "Dr. Stephen Henson" Date: Thu, 20 Nov 2014 14:06:50 +0000 Subject: [PATCH] Fix SuiteB chain checking logic. Reviewed-by: Matt Caswell (cherry picked from commit 7255ca99df1f2d83d99d113dd5ca54b88d50e72b) --- ssl/t1_lib.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c index 8e802a2e3f..d02ae19d58 100644 --- a/ssl/t1_lib.c +++ b/ssl/t1_lib.c @@ -4240,13 +4240,10 @@ int tls1_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain, if (check_flags) check_flags |= CERT_PKEY_SUITEB; ok = X509_chain_check_suiteb(NULL, x, chain, suiteb_flags); - if (ok != X509_V_OK) - { - if (check_flags) - rv |= CERT_PKEY_SUITEB; - else - goto end; - } + if (ok == X509_V_OK) + rv |= CERT_PKEY_SUITEB; + else if (!check_flags) + goto end; } /* Check all signature algorithms are consistent with -- 2.50.1