Attachment #175631 for bug #251346

Lines 2132-2138 Link Here

(-)openssl-0.9.8i/apps/speed.c (-1 / +1 lines)
2132	{	2132	{
2133	ret=RSA_verify(NID_md5_sha1, buf,36, buf2,	2133	ret=RSA_verify(NID_md5_sha1, buf,36, buf2,
2134	rsa_num, rsa_key[j]);	2134	rsa_num, rsa_key[j]);
2135	if (ret == 0)	2135	if (ret <= 0)
2136	{	2136	{
2137	BIO_printf(bio_err,	2137	BIO_printf(bio_err,
2138	"RSA verify failure\n");	2138	"RSA verify failure\n");

Lines 285-291 Link Here

(-)openssl-0.9.8i-ORIG/apps/spkac.c (-1 / +1 lines)
285	pkey = NETSCAPE_SPKI_get_pubkey(spki);	285	pkey = NETSCAPE_SPKI_get_pubkey(spki);
286	if(verify) {	286	if(verify) {
287	i = NETSCAPE_SPKI_verify(spki, pkey);	287	i = NETSCAPE_SPKI_verify(spki, pkey);
288	if(i) BIO_printf(bio_err, "Signature OK\n");	288	if (i > 0) BIO_printf(bio_err, "Signature OK\n");
289	else {	289	else {
290	BIO_printf(bio_err, "Signature Failure\n");	290	BIO_printf(bio_err, "Signature Failure\n");
291	ERR_print_errors(bio_err);	291	ERR_print_errors(bio_err);

Lines 266-272 Link Here

(-)openssl-0.9.8i-ORIG/apps/verify.c (-2 / +1 lines)
266	ret=0;	266	ret=0;
267	end:	267	end:
268	if (i)	268	if (i > 0)
269	{	269	{
270	fprintf(stdout,"OK\n");	270	fprintf(stdout,"OK\n");
271	ret=1;	271	ret=1;
Lines 367-370 Link Here
367	ERR_clear_error();	367	ERR_clear_error();
368	return(ok);	368	return(ok);
369	}	369	}
370

Lines 1151-1157 Link Here

(-)openssl-0.9.8i-ORIG/apps/x509.c (-1 / +1 lines)
1151	/* NOTE: this certificate can/should be self signed, unless it was	1151	/* NOTE: this certificate can/should be self signed, unless it was
1152	* a certificate request in which case it is not. */	1152	* a certificate request in which case it is not. */
1153	X509_STORE_CTX_set_cert(&xsc,x);	1153	X509_STORE_CTX_set_cert(&xsc,x);
1154	if (!reqfile && !X509_verify_cert(&xsc))	1154	if (!reqfile && X509_verify_cert(&xsc) <= 0)
1155	goto end;	1155	goto end;
1156	if (!X509_check_private_key(xca,pkey))	1156	if (!X509_check_private_key(xca,pkey))

Lines 830-836 Link Here

(-)openssl-0.9.8i-ORIG/crypto/cms/cms_sd.c (-1 / +1 lines)
830	cms_fixup_mctx(&mctx, si->pkey);	830	cms_fixup_mctx(&mctx, si->pkey);
831	r = EVP_VerifyFinal(&mctx,	831	r = EVP_VerifyFinal(&mctx,
832	si->signature->data, si->signature->length, si->pkey);	832	si->signature->data, si->signature->length, si->pkey);
833	if (!r)	833	if (r <= 0)
834	CMSerr(CMS_F_CMS_SIGNERINFO_VERIFY, CMS_R_VERIFICATION_FAILURE);	834	CMSerr(CMS_F_CMS_SIGNERINFO_VERIFY, CMS_R_VERIFICATION_FAILURE);
835	err:	835	err:
836	EVP_MD_CTX_cleanup(&mctx);	836	EVP_MD_CTX_cleanup(&mctx);

Lines 1044-1050 Link Here

(-)openssl-0.9.8i-ORIG/ssl/s2_clnt.c (-1 / +1 lines)
1044	i=ssl_verify_cert_chain(s,sk);	1044	i=ssl_verify_cert_chain(s,sk);
1045		1045
1046	if ((s->verify_mode != SSL_VERIFY_NONE) && (!i))	1046	if ((s->verify_mode != SSL_VERIFY_NONE) && (i <= 0))
1047	{	1047	{
1048	SSLerr(SSL_F_SSL2_SET_CERTIFICATE,SSL_R_CERTIFICATE_VERIFY_FAILED);	1048	SSLerr(SSL_F_SSL2_SET_CERTIFICATE,SSL_R_CERTIFICATE_VERIFY_FAILED);
1049	goto err;	1049	goto err;

Lines 1054-1060 Link Here

(-)openssl-0.9.8i-ORIG/ssl/s2_srvr.c (-2 / +2 lines)
1054	i=ssl_verify_cert_chain(s,sk);	1054	i=ssl_verify_cert_chain(s,sk);
1055	if (i) /* we like the packet, now check the chksum */	1055	if (i > 0) /* we like the packet, now check the chksum */
1056	{	1056	{
1057	EVP_MD_CTX ctx;	1057	EVP_MD_CTX ctx;
1058	EVP_PKEY *pkey=NULL;	1058	EVP_PKEY *pkey=NULL;
Lines 1083-1089 Link Here
1083	EVP_PKEY_free(pkey);	1083	EVP_PKEY_free(pkey);
1084	EVP_MD_CTX_cleanup(&ctx);	1084	EVP_MD_CTX_cleanup(&ctx);
1085	if (i)	1085	if (i > 0)
1086	{	1086	{
1087	if (s->session->peer != NULL)	1087	if (s->session->peer != NULL)
1088	X509_free(s->session->peer);	1088	X509_free(s->session->peer);




		}
	i=ssl_verify_cert_chain(s,sk);
	if ((s->verify_mode != SSL_VERIFY_NONE) && (i <= 0)
#ifndef OPENSSL_NO_KRB5
	        && (s->s3->tmp.new_cipher->algorithms & (SSL_MKEY_MASK|SSL_AUTH_MASK))
	        != (SSL_aKRB5|SSL_kKRB5)

			EVP_VerifyUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE);
			EVP_VerifyUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE);
			EVP_VerifyUpdate(&md_ctx,param,param_len);
			if (EVP_VerifyFinal(&md_ctx,p,(int)n,pkey) <= 0)
				{
				/* bad signature */
				al=SSL_AD_DECRYPT_ERROR;

			EVP_VerifyUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE);
			EVP_VerifyUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE);
			EVP_VerifyUpdate(&md_ctx,param,param_len);
			if (EVP_VerifyFinal(&md_ctx,p,(int)n,pkey) <= 0)
				{
				/* bad signature */
				al=SSL_AD_DECRYPT_ERROR;

Lines 2560-2566 Link Here

(-)openssl-0.9.8i-ORIG/ssl/s3_srvr.c (-1 / +1 lines)
2560	else	2560	else
2561	{	2561	{
2562	i=ssl_verify_cert_chain(s,sk);	2562	i=ssl_verify_cert_chain(s,sk);
2563	if (!i)	2563	if (i <= 0)
2564	{	2564	{
2565	al=ssl_verify_alarm_type(s->verify_result);	2565	al=ssl_verify_alarm_type(s->verify_result);
2566	SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,SSL_R_NO_CERTIFICATE_RETURNED);	2566	SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,SSL_R_NO_CERTIFICATE_RETURNED);

Lines 2093-2099 Link Here

(-)openssl-0.9.8i-ORIG/ssl/ssltest.c (-1 / +1 lines)
2093	if (cb_arg->proxy_auth)	2093	if (cb_arg->proxy_auth)
2094	{	2094	{
2095	if (ok)	2095	if (ok > 0)
2096	{	2096	{
2097	const char *cond_end = NULL;	2097	const char *cond_end = NULL;

Return to bug 251346

Lines 972-978 Link Here

(-)openssl-0.9.8i-ORIG/ssl/s3_clnt.c (-3 / +3 lines)
972	}	972	}
973	i=ssl_verify_cert_chain(s,sk);	973	i=ssl_verify_cert_chain(s,sk);
974	if ((s->verify_mode != SSL_VERIFY_NONE) && (!i)	974	if ((s->verify_mode != SSL_VERIFY_NONE) && (i <= 0)
975	#ifndef OPENSSL_NO_KRB5	975	#ifndef OPENSSL_NO_KRB5
976	&& (s->s3->tmp.new_cipher->algorithms & (SSL_MKEY_MASK\|SSL_AUTH_MASK))	976	&& (s->s3->tmp.new_cipher->algorithms & (SSL_MKEY_MASK\|SSL_AUTH_MASK))
977	!= (SSL_aKRB5\|SSL_kKRB5)	977	!= (SSL_aKRB5\|SSL_kKRB5)
Lines 1459-1465 Link Here
1459	EVP_VerifyUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE);	1459	EVP_VerifyUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE);
1460	EVP_VerifyUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE);	1460	EVP_VerifyUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE);
1461	EVP_VerifyUpdate(&md_ctx,param,param_len);	1461	EVP_VerifyUpdate(&md_ctx,param,param_len);
1462	if (!EVP_VerifyFinal(&md_ctx,p,(int)n,pkey))	1462	if (EVP_VerifyFinal(&md_ctx,p,(int)n,pkey) <= 0)
1463	{	1463	{
1464	/* bad signature */	1464	/* bad signature */
1465	al=SSL_AD_DECRYPT_ERROR;	1465	al=SSL_AD_DECRYPT_ERROR;
Lines 1477-1483 Link Here
1477	EVP_VerifyUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE);	1477	EVP_VerifyUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE);
1478	EVP_VerifyUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE);	1478	EVP_VerifyUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE);
1479	EVP_VerifyUpdate(&md_ctx,param,param_len);	1479	EVP_VerifyUpdate(&md_ctx,param,param_len);
1480	if (!EVP_VerifyFinal(&md_ctx,p,(int)n,pkey))	1480	if (EVP_VerifyFinal(&md_ctx,p,(int)n,pkey) <= 0)
1481	{	1481	{
1482	/* bad signature */	1482	/* bad signature */
1483	al=SSL_AD_DECRYPT_ERROR;	1483	al=SSL_AD_DECRYPT_ERROR;