From: Dr. Stephen Henson <steve@openssl.org>
Date: Thu, 20 Nov 2014 14:06:50 +0000 (+0000)
Subject: Fix SuiteB chain checking logic.
X-Git-Tag: master-post-reformat~276
X-Git-Url: https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff_plain;h=7255ca99df1f2d83d99d113dd5ca54b88d50e72b

Fix SuiteB chain checking logic.

Reviewed-by: Matt Caswell <matt@openssl.org>
---

diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c
index 8b2b16bc87..e0f28d254b 100644
--- a/ssl/t1_lib.c
+++ b/ssl/t1_lib.c
@@ -4294,13 +4294,10 @@ int tls1_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain,
 		if (check_flags)
 			check_flags |= CERT_PKEY_SUITEB;
 		ok = X509_chain_check_suiteb(NULL, x, chain, suiteb_flags);
-		if (ok != X509_V_OK)
-			{
-			if (check_flags)
-				rv |= CERT_PKEY_SUITEB;
-			else
-				goto end;
-			}
+		if (ok == X509_V_OK)
+			rv |= CERT_PKEY_SUITEB;
+		else if (!check_flags)
+			goto end;
 		}
 
 	/* Check all signature algorithms are consistent with