From 946d919740934c98441936fe647a8e623983b6fe Mon Sep 17 00:00:00 2001 From: Rob Austein Date: Fri, 11 Aug 2006 20:09:51 +0000 Subject: Trivial change: move path validation checks into check_chain_extensions(), just to be tidy. svn path=/openssl/trunk/crypto/x509/x509_vfy.c; revision=145 --- openssl/trunk/crypto/x509/x509_vfy.c | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-) (limited to 'openssl/trunk/crypto/x509/x509_vfy.c') diff --git a/openssl/trunk/crypto/x509/x509_vfy.c b/openssl/trunk/crypto/x509/x509_vfy.c index 47b15455..713109b5 100644 --- a/openssl/trunk/crypto/x509/x509_vfy.c +++ b/openssl/trunk/crypto/x509/x509_vfy.c @@ -289,15 +289,6 @@ int X509_verify_cert(X509_STORE_CTX *ctx) if (!ok) goto end; - /* Check RFC 3779 path validation */ - ok = v3_asid_validate_path(ctx); - - if (!ok) goto end; - - ok = v3_addr_validate_path(ctx); - - if (!ok) goto end; - /* The chain extensions are OK: check trust */ if (param->trust > 0) ok = check_trust(ctx); @@ -527,6 +518,11 @@ static int check_chain_extensions(X509_STORE_CTX *ctx) else must_be_ca = 1; } + /* RFC 3779 path validation */ + ok = v3_asid_validate_path(ctx); + if (!ok) goto end; + ok = v3_addr_validate_path(ctx); + if (!ok) goto end; ok = 1; end: return ok; -- cgit v1.2.3