2 ms·
Now look at their insane API. The ssl verify returns Verify a certificate chain * Return codes: * 1: Verify success * 0: Verify failure or e
by rurban 5y ago
Now look at their insane API.
The ssl verify returns
Verify a certificate chain
* Return codes:
* 1: Verify success
* 0: Verify failure or error
* -1: Retry required
*/
But the x509 cert verify returns -1 for verification error.
- mjg59 5y agoRight. Previously the return code from x509_verify_cert was returned directly to the caller, which was incorrect - ssl_verify_chain_cert was supposed to return -1 if the caller should retry, but would end up doing so on any error that was returned from x509_verify_cert. So the patch is correct. If your argument is that the return codes should be consistent across different layers of OpenSSL then I'm not going to disagree, but this is a large old codebase and this isn't some unique case.
- dc-programmer 5y agoI’m pretty sure this has caused CVEs before. Folks will check !ret and call it a day.
- GoblinSlayer 5y agoYou just never used OpenSSL, their API is legendary.