diff options
| author | Ben Laurie <ben@openssl.org> | 2012-12-11 16:05:14 +0000 |
|---|---|---|
| committer | Ben Laurie <ben@openssl.org> | 2012-12-11 16:05:14 +0000 |
| commit | fefc111a2a0070aa51fd59b7e9db652098ee5c06 (patch) | |
| tree | eee09063a42d416d0ab5e19eef2d61bdb9e33dde | |
| parent | b204ab650636ae2ea794c4c5b2f324977f62da99 (diff) | |
| download | openssl-fefc111a2a0070aa51fd59b7e9db652098ee5c06.tar.gz | |
Make openssl verify return errors.
| -rw-r--r-- | CHANGES | 4 | ||||
| -rw-r--r-- | Makefile.org | 2 | ||||
| -rw-r--r-- | apps/verify.c | 16 | ||||
| -rw-r--r-- | test/Makefile | 2 |
4 files changed, 18 insertions, 6 deletions
@@ -3,6 +3,10 @@ _______________ Changes between 1.0.x and 1.1.0 [xx XXX xxxx] + + *) Make openssl verify return errors. + [Chris Palmer <palmer@google.com> and Ben Laurie] + *) Fix OCSP checking. [Rob Stradling <rob.stradling@comodo.com> and Ben Laurie] diff --git a/Makefile.org b/Makefile.org index e8e235ddc1..428cbbb983 100644 --- a/Makefile.org +++ b/Makefile.org @@ -540,7 +540,7 @@ rehash.time: certs apps [ -x "apps/openssl.exe" ] && OPENSSL="apps/openssl.exe" || :; \ OPENSSL_DEBUG_MEMORY=on; \ export OPENSSL OPENSSL_DEBUG_MEMORY; \ - $(PERL) tools/c_rehash certs) && \ + $(PERL) tools/c_rehash certs/demo) && \ touch rehash.time; \ else :; fi diff --git a/apps/verify.c b/apps/verify.c index bcca114efe..b03085bf87 100644 --- a/apps/verify.c +++ b/apps/verify.c @@ -228,11 +228,19 @@ int MAIN(int argc, char **argv) if (crl_download) store_setup_crl_download(cert_ctx); - if (argc < 1) check(cert_ctx, NULL, untrusted, trusted, crls, e); + ret=0; + if (argc < 1) + { + if (1 != check(cert_ctx, NULL, untrusted, trusted, crls, e)) + ret=-1; + } else + { for (i=0; i<argc; i++) - check(cert_ctx,argv[i], untrusted, trusted, crls, e); - ret=0; + if (1 != check(cert_ctx,argv[i], untrusted, trusted, crls, e)) + ret=-1; + } + end: if (ret == 1) { BIO_printf(bio_err,"usage: verify [-verbose] [-CApath path] [-CAfile file] [-purpose purpose] [-crl_check]"); @@ -267,7 +275,7 @@ end: sk_X509_pop_free(trusted, X509_free); sk_X509_CRL_pop_free(crls, X509_CRL_free); apps_shutdown(); - OPENSSL_EXIT(ret); + OPENSSL_EXIT(ret < 0 ? 2 : ret); } static int check(X509_STORE *ctx, char *file, diff --git a/test/Makefile b/test/Makefile index b919533b37..93619504ff 100644 --- a/test/Makefile +++ b/test/Makefile @@ -294,7 +294,7 @@ test_ecdh: test_verify: @echo "The following command should have some OK's and some failures" @echo "There are definitly a few expired certificates" - ../util/shlib_wrap.sh ../apps/openssl verify -CApath ../certs ../certs/*.pem + ../util/shlib_wrap.sh ../apps/openssl verify -CApath ../certs/demo ../certs/demo/*.pem test_dh: @echo "Generate a set of DH parameters" |