--- openssl/crypto/x509/x509_trs.c.orig    4 Dec 2012 17:26:04 -0000    1.133.2.11.2.6.2.3

+++ openssl/crypto/x509/x509_trs.c    14 Dec 2012 14:30:45 -0000    1.133.2.11.2.6.2.4

@@ -119,6 +119,14 @@ int X509_check_trust(X509 *x, int id, int flags)

     int idx;

     if (id == -1)

         return 1;

+    /* We get this as a default value */

+    if (id == 0) {

+        int rv;

+        rv = obj_trust(NID_anyExtendedKeyUsage, x, 0);

+        if (rv != X509_TRUST_UNTRUSTED)

+            return rv;

+        return trust_compat(NULL, x, 0);

+    }

     idx = X509_TRUST_get_by_id(id);

     if (idx == -1)

         return default_trust(id, x, flags);

--- openssl/crypto/x509/x509_vfy.c    14 Dec 2012 12:53:48 -0000    1.105.2.9.2.4.2.3

+++ openssl/crypto/x509/x509_vfy.c    14 Dec 2012 14:30:46 -0000    1.105.2.9.2.4.2.4

@@ -149,6 +149,33 @@

 }

+    {

+    STACK_OF(X509) *certs;

+    X509 *xtmp = NULL;

+    int i;

+    /* Lookup all certs with matching subject name */

+    certs = ctx->lookup_certs(ctx, X509_get_subject_name(x));

+    if (certs == NULL)

+        return NULL;

+    /* Look for exact match */

+    for (i = 0; i < sk_X509_num(certs); i++)

+        {

+        xtmp = sk_X509_value(certs, i);

+        if (!X509_cmp(xtmp, x))

+            break;

+        }

+    if (i < sk_X509_num(certs))

+        CRYPTO_add(&xtmp->references,1,CRYPTO_LOCK_X509);

+    else

+        xtmp = NULL;

+    sk_X509_pop_free(certs, X509_free);

+    return xtmp;

+    }

 {

     X509 *x, *xtmp, *chain_ss = NULL;

@@ -304,8 +331,17 @@ int X509_verify_cert(X509_STORE_CTX *ctx)

     /* we now have our chain, lets check it... */

-    /* Is last certificate looked up self signed? */

-    if (!ctx->check_issued(ctx, x, x)) {

+    i = check_trust(ctx);

+    /* If explicitly rejected error */

+    if (i == X509_TRUST_REJECTED)

+        goto end;

+    /*

+     * If not explicitly trusted then indicate error unless it's a single

+     * self signed certificate in which case we've indicated an error already

+     * and set bad_chain == 1

+     */

+    if (i != X509_TRUST_TRUSTED && !bad_chain) {

         if ((chain_ss == NULL) || !ctx->check_issued(ctx, x, chain_ss)) {

             if (ctx->last_untrusted >= num)

                 ctx->error = X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY;

@@ -340,14 +376,6 @@ int X509_verify_cert(X509_STORE_CTX *ctx)

     ok = check_name_constraints(ctx);

     if (!ok)

-        goto end;

-    /* The chain extensions are OK: check trust */

-    if (param->trust > 0)

-        ok = check_trust(ctx);

-    if (!ok)

         goto end;

     /* We may as well copy down any DSA parameters that are required */

@@ -630,28 +658,53 @@ static int check_name_constraints(X509_STORE_CTX *ctx)

-    return 1;

     int i, ok;

-    X509 *x;

+    X509 *x = NULL;

     int (*cb) (int xok, X509_STORE_CTX *xctx);

     cb = ctx->verify_cb;

-    i = sk_X509_num(ctx->chain) - 1;

-    x = sk_X509_value(ctx->chain, i);

-    ok = X509_check_trust(x, ctx->param->trust, 0);

-    if (ok == X509_TRUST_TRUSTED)

-        return 1;

-    ctx->error_depth = i;

-    ctx->current_cert = x;

-    if (ok == X509_TRUST_REJECTED)

-        ctx->error = X509_V_ERR_CERT_REJECTED;

-    else

-        ctx->error = X509_V_ERR_CERT_UNTRUSTED;

-    ok = cb(0, ctx);

-    return ok;

+    /* Check all trusted certificates in chain */

+    for (i = ctx->last_untrusted; i < sk_X509_num(ctx->chain); i++) {

+        x = sk_X509_value(ctx->chain, i);

+        ok = X509_check_trust(x, ctx->param->trust, 0);

+        /* If explicitly trusted return trusted */

+        if (ok == X509_TRUST_TRUSTED)

+            return X509_TRUST_TRUSTED;

+        /*

+         * If explicitly rejected notify callback and reject if not

+         * overridden.

+         */

+        if (ok == X509_TRUST_REJECTED) {

+            ctx->error_depth = i;

+            ctx->current_cert = x;

+            ctx->error = X509_V_ERR_CERT_REJECTED;

+            ok = cb(0, ctx);

+            if (!ok)

+                return X509_TRUST_REJECTED;

+        }

+    }

+    /*

+     * If we accept partial chains and have at least one trusted certificate

+     * return success.

+     */

+    if (ctx->param->flags & X509_V_FLAG_PARTIAL_CHAIN) {

+        X509 *mx;

+        if (ctx->last_untrusted < sk_X509_num(ctx->chain))

+            return X509_TRUST_TRUSTED;

+        x = sk_X509_value(ctx->chain, 0);

+        mx = lookup_cert_match(ctx, x);

+        if (mx) {

+            (void)sk_X509_set(ctx->chain, 0, mx);

+            X509_free(x);

+            ctx->last_untrusted = 0;

+            return X509_TRUST_TRUSTED;

+        }

+    }

+    /*

+     * If no trusted certs in chain at all return untrusted and allow

+     * standard (no issuer cert) etc errors to be indicated.

+     */

+    return X509_TRUST_UNTRUSTED;

@@ -1526,6 +1579,8 @@ static int internal_verify(X509_STORE_CTX *ctx)

     if (ctx->check_issued(ctx, xi, xi))

         xs = xi;

     else {

+        if (ctx->param->flags & X509_V_FLAG_PARTIAL_CHAIN && n == 0)

+            return check_cert_time(ctx, xi);

         if (n <= 0) {

             ctx->error = X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE;

             ctx->current_cert = xi;

--- openssl/crypto/x509/x509_vfy.h    26 Sep 2012 13:50:42 -0000    1.67.2.3.4.1

+++ openssl/crypto/x509/x509_vfy.h    14 Dec 2012 14:30:46 -0000    1.67.2.3.4.2

@@ -406,6 +406,9 @@

 # define X509_V_FLAG_CHECK_SS_SIGNATURE          0x4000

+# define X509_V_FLAG_PARTIAL_CHAIN               0x80000

+

 # define X509_VP_FLAG_DEFAULT                    0x1

 # define X509_VP_FLAG_OVERWRITE                  0x2

 # define X509_VP_FLAG_RESET_FLAGS                0x4

--- openssl/apps/apps.c    4 Dec 2012 17:26:04 -0000    1.133.2.11.2.6.2.3

+++ openssl/apps/apps.c    14 Dec 2012 14:30:45 -0000    1.133.2.11.2.6.2.4

@@ -2238,6 +2238,8 @@

         flags |= X509_V_FLAG_NOTIFY_POLICY;

     else if (!strcmp(arg, "-check_ss_sig"))

         flags |= X509_V_FLAG_CHECK_SS_SIGNATURE;

+    else if (!strcmp(arg, "-partial_chain"))

+        flags |= X509_V_FLAG_PARTIAL_CHAIN;

     else

         return 0;