add -trusted_first option and verify flag (backport from HEAD)

[openssl.git] / crypto / x509 / x509_vfy.c

diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c
index b0779db0231b314d8fcfe009d6e2cbb985585da9..ba10811f80bf46b842fc4710a8f9be0e85f696ac 100644 (file)
--- a/crypto/x509/x509_vfy.c
+++ b/crypto/x509/x509_vfy.c
@@ -206,6 +206,22 @@ int X509_verify_cert(X509_STORE_CTX *ctx)
                /* If we are self signed, we break */
                if (ctx->check_issued(ctx, x,x)) break;
 
+               /* If asked see if we can find issuer in trusted store first */
+               if (ctx->param->flags & X509_V_FLAG_TRUSTED_FIRST)
+                       {
+                       ok = ctx->get_issuer(&xtmp, ctx, x);
+                       if (ok < 0)
+                               return ok;
+                       /* If successful for now free up cert so it
+                        * will be picked up again later.
+                        */
+                       if (ok > 0)
+                               {
+                               X509_free(xtmp);
+                               break;
+                               }
+                       }
+
                /* If we were passed a cert chain, use it first */
                if (ctx->untrusted != NULL)
                        {