Add three Suite B modes to TLS code, supporting RFC6460.

[openssl.git] / ssl / ssl_cert.c

diff --git a/ssl/ssl_cert.c b/ssl/ssl_cert.c
index 470ac17098c9f0f2a7f6f716f3fcf30e2b8e9457..6dfde2f8da5950354922f2200e48106d7e035922 100644 (file)
--- a/ssl/ssl_cert.c
+++ b/ssl/ssl_cert.c
@@ -692,6 +692,8 @@ int ssl_verify_cert_chain(SSL *s,STACK_OF(X509) *sk)
                SSLerr(SSL_F_SSL_VERIFY_CERT_CHAIN,ERR_R_X509_LIB);
                return(0);
                }
+       /* Set suite B flags if needed */
+       X509_STORE_CTX_set_flags(&ctx, tls1_suiteb(s));
 #if 0
        if (SSL_get_verify_depth(s) >= 0)
                X509_STORE_CTX_set_depth(&ctx, SSL_get_verify_depth(s));
@@ -1151,6 +1153,8 @@ int ssl_build_cert_chain(CERT *c, X509_STORE *chain_store, int flags)
                SSLerr(SSL_F_SSL_BUILD_CERT_CHAIN, ERR_R_X509_LIB);
                return 0;
                }
+       /* Set suite B flags if needed */
+       X509_STORE_CTX_set_flags(&xs_ctx, c->cert_flags & SSL_CERT_FLAG_SUITEB_128_LOS);
 
        i = X509_verify_cert(&xs_ctx);
        if (i > 0)