3 ms·
It's documented as returning 1 when verification succeeds and 0 when it fails, so this appears to turn an error into a failure to verify, which seems to be the
by mjg59 5y ago
It's documented as returning 1 when verification succeeds and 0 when it fails, so this appears to turn an error into a failure to verify, which seems to be the intent?
- rurban 5y agoNow look at their insane API. The ssl verify returns Verify a certificate chain * Return codes: * 1: Verify success * 0: Verify failure or error * -1: Retry required */ But the x509 cert verify returns -1 for verification error.
- mjg59 5y agoRight. Previously the return code from x509_verify_cert was returned directly to the caller, which was incorrect - ssl_verify_chain_cert was supposed to return -1 if the caller should retry, but would end up doing so on any error that was returned from x509_verify_cert. So the patch is correct. If your argument is that the return codes should be consistent across different layers of OpenSSL then I'm not going to disagree, but this is a large old codebase and this isn't some unique case.
- dc-programmer 5y agoI’m pretty sure this has caused CVEs before. Folks will check !ret and call it a day.
- GoblinSlayer 5y agoYou just never used OpenSSL, their API is legendary.