diff options
| author | tb <> | 2020-10-26 11:48:39 +0000 |
|---|---|---|
| committer | tb <> | 2020-10-26 11:48:39 +0000 |
| commit | d3ea9013dad42cd8c8569e9a061e851b2f3b757e (patch) | |
| tree | f53b0c8f8b7f3bc6441adb37e2bd4974fd543d72 /src | |
| parent | a32c02b8b29460995ef1893cecee58117c22d2e7 (diff) | |
| download | openbsd-d3ea9013dad42cd8c8569e9a061e851b2f3b757e.tar.gz openbsd-d3ea9013dad42cd8c8569e9a061e851b2f3b757e.tar.bz2 openbsd-d3ea9013dad42cd8c8569e9a061e851b2f3b757e.zip | |
Add a -legacy_verify flag to force use of the old validator for debugging
and testing purposes.
ok beck inoguchi jsing
Diffstat (limited to 'src')
| -rw-r--r-- | src/usr.bin/openssl/apps.c | 4 | ||||
| -rw-r--r-- | src/usr.bin/openssl/openssl.1 | 7 | ||||
| -rw-r--r-- | src/usr.bin/openssl/verify.c | 6 |
3 files changed, 13 insertions, 4 deletions
diff --git a/src/usr.bin/openssl/apps.c b/src/usr.bin/openssl/apps.c index e1dcd48b37..2c228aad59 100644 --- a/src/usr.bin/openssl/apps.c +++ b/src/usr.bin/openssl/apps.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: apps.c,v 1.56 2020/10/14 07:20:09 tb Exp $ */ | 1 | /* $OpenBSD: apps.c,v 1.57 2020/10/26 11:48:39 tb Exp $ */ |
| 2 | /* | 2 | /* |
| 3 | * Copyright (c) 2014 Joel Sing <jsing@openbsd.org> | 3 | * Copyright (c) 2014 Joel Sing <jsing@openbsd.org> |
| 4 | * | 4 | * |
| @@ -1916,6 +1916,8 @@ args_verify(char ***pargs, int *pargc, int *badarg, BIO *err, | |||
| 1916 | flags |= X509_V_FLAG_POLICY_CHECK; | 1916 | flags |= X509_V_FLAG_POLICY_CHECK; |
| 1917 | else if (!strcmp(arg, "-explicit_policy")) | 1917 | else if (!strcmp(arg, "-explicit_policy")) |
| 1918 | flags |= X509_V_FLAG_EXPLICIT_POLICY; | 1918 | flags |= X509_V_FLAG_EXPLICIT_POLICY; |
| 1919 | else if (!strcmp(arg, "-legacy_verify")) | ||
| 1920 | flags |= X509_V_FLAG_LEGACY_VERIFY; | ||
| 1919 | else if (!strcmp(arg, "-inhibit_any")) | 1921 | else if (!strcmp(arg, "-inhibit_any")) |
| 1920 | flags |= X509_V_FLAG_INHIBIT_ANY; | 1922 | flags |= X509_V_FLAG_INHIBIT_ANY; |
| 1921 | else if (!strcmp(arg, "-inhibit_map")) | 1923 | else if (!strcmp(arg, "-inhibit_map")) |
diff --git a/src/usr.bin/openssl/openssl.1 b/src/usr.bin/openssl/openssl.1 index e364586f5a..474f00f493 100644 --- a/src/usr.bin/openssl/openssl.1 +++ b/src/usr.bin/openssl/openssl.1 | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | .\" $OpenBSD: openssl.1,v 1.125 2020/07/14 09:52:46 inoguchi Exp $ | 1 | .\" $OpenBSD: openssl.1,v 1.126 2020/10/26 11:48:39 tb Exp $ |
| 2 | .\" ==================================================================== | 2 | .\" ==================================================================== |
| 3 | .\" Copyright (c) 1998-2002 The OpenSSL Project. All rights reserved. | 3 | .\" Copyright (c) 1998-2002 The OpenSSL Project. All rights reserved. |
| 4 | .\" | 4 | .\" |
| @@ -110,7 +110,7 @@ | |||
| 110 | .\" copied and put under another distribution licence | 110 | .\" copied and put under another distribution licence |
| 111 | .\" [including the GNU Public Licence.] | 111 | .\" [including the GNU Public Licence.] |
| 112 | .\" | 112 | .\" |
| 113 | .Dd $Mdocdate: July 14 2020 $ | 113 | .Dd $Mdocdate: October 26 2020 $ |
| 114 | .Dt OPENSSL 1 | 114 | .Dt OPENSSL 1 |
| 115 | .Os | 115 | .Os |
| 116 | .Sh NAME | 116 | .Sh NAME |
| @@ -5859,6 +5859,7 @@ The default is no. | |||
| 5859 | .Op Fl inhibit_any | 5859 | .Op Fl inhibit_any |
| 5860 | .Op Fl inhibit_map | 5860 | .Op Fl inhibit_map |
| 5861 | .Op Fl issuer_checks | 5861 | .Op Fl issuer_checks |
| 5862 | .Op Fl legacy_verify | ||
| 5862 | .Op Fl policy_check | 5863 | .Op Fl policy_check |
| 5863 | .Op Fl purpose Ar purpose | 5864 | .Op Fl purpose Ar purpose |
| 5864 | .Op Fl trusted Ar file | 5865 | .Op Fl trusted Ar file |
| @@ -5931,6 +5932,8 @@ showing why each candidate issuer certificate was rejected. | |||
| 5931 | The presence of rejection messages | 5932 | The presence of rejection messages |
| 5932 | does not itself imply that anything is wrong: | 5933 | does not itself imply that anything is wrong: |
| 5933 | during the normal verify process several rejections may take place. | 5934 | during the normal verify process several rejections may take place. |
| 5935 | .It Fl legacy_verify | ||
| 5936 | Use the legacy X.509 certificate chain verification code. | ||
| 5934 | .It Fl policy_check | 5937 | .It Fl policy_check |
| 5935 | Enable certificate policy processing. | 5938 | Enable certificate policy processing. |
| 5936 | .It Fl purpose Ar purpose | 5939 | .It Fl purpose Ar purpose |
diff --git a/src/usr.bin/openssl/verify.c b/src/usr.bin/openssl/verify.c index 3da41b917a..e4443148ce 100644 --- a/src/usr.bin/openssl/verify.c +++ b/src/usr.bin/openssl/verify.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: verify.c,v 1.8 2020/07/14 19:08:30 jsing Exp $ */ | 1 | /* $OpenBSD: verify.c,v 1.9 2020/10/26 11:48:39 tb Exp $ */ |
| 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) |
| 3 | * All rights reserved. | 3 | * All rights reserved. |
| 4 | * | 4 | * |
| @@ -193,6 +193,10 @@ static const struct option verify_shared_options[] = { | |||
| 193 | .desc = "Enable debugging of certificate issuer checks", | 193 | .desc = "Enable debugging of certificate issuer checks", |
| 194 | }, | 194 | }, |
| 195 | { | 195 | { |
| 196 | .name = "legacy_verify", | ||
| 197 | .desc = "Use legacy certificate chain verification", | ||
| 198 | }, | ||
| 199 | { | ||
| 196 | .name = "policy", | 200 | .name = "policy", |
| 197 | .argname = "name", | 201 | .argname = "name", |
| 198 | .desc = "Add given policy to the acceptable set", | 202 | .desc = "Add given policy to the acceptable set", |