From 9107b5fdd3d436ef3e6537c35bbb2d200445cb7b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Manuel=20P=C3=A9gouri=C3=A9-Gonnard?= Date: Thu, 6 Jul 2017 12:16:25 +0200 Subject: [PATCH] Improve comments --- library/x509_crt.c | 4 +++- tests/ssl-opt.sh | 2 ++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/library/x509_crt.c b/library/x509_crt.c index ec5f77268..3b8614125 100644 --- a/library/x509_crt.c +++ b/library/x509_crt.c @@ -2310,7 +2310,9 @@ int mbedtls_x509_crt_verify_with_profile( mbedtls_x509_crt *crt, } exit: - /* prevent misuse of the vrfy callback */ + /* prevent misuse of the vrfy callback - VERIFY_FAILED would be ignored by + * the SSL module for authmode optional, but non-zero return from the + * callback means a fatal error so it shouldn't be ignored */ if( ret == MBEDTLS_ERR_X509_CERT_VERIFY_FAILED ) ret = MBEDTLS_ERR_X509_FATAL_ERROR; diff --git a/tests/ssl-opt.sh b/tests/ssl-opt.sh index 4f84cda25..98d55f51c 100755 --- a/tests/ssl-opt.sh +++ b/tests/ssl-opt.sh @@ -2103,6 +2103,8 @@ run_test "Authentication: client no cert, ssl3" \ -C "! mbedtls_ssl_handshake returned" \ -S "X509 - Certificate verification failed" +# The "max_int chain" tests assume that MAX_INTERMEDIATE_CA is set to its +# default value (8) run_test "Authentication: server max_int chain, client default" \ "$P_SRV crt_file=data_files/dir-maxpath/c09.pem \ key_file=data_files/dir-maxpath/09.key" \