commit 77644f2815fa281fcadbb665f71b240e42e31ecb
author Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com> Mon Jul 10 11:35:53 2017 +0200
committer Simon Butcher <simon.butcher@arm.com> Fri Jul 28 13:15:57 2017 +0100
tree ecd6e487a4249596fadc65a336e21460443c9db8
parent df745670e1225649053973f8dfab4cd0e8709f74

Improve comments

library/x509_crt.c

diff --git a/library/x509_crt.c b/library/x509_crt.c
index fb09253..3652a8c 100644
--- a/library/x509_crt.c
+++ b/library/x509_crt.c
@@ -2174,7 +2174,9 @@
     }
 
 exit:
-    /* prevent misuse of the vrfy callback */
+    /* prevent misuse of the vrfy callback - VERIFY_FAILED would be ignored by
+     * the SSL module for authmode optional, but non-zero return from the
+     * callback means a fatal error so it shouldn't be ignored */
     if( ret == POLARSSL_ERR_X509_CERT_VERIFY_FAILED )
         ret = POLARSSL_ERR_X509_FATAL_ERROR;
 

tests/ssl-opt.sh

diff --git a/tests/ssl-opt.sh b/tests/ssl-opt.sh
index dcb758c..5e4aeac 100755
--- a/tests/ssl-opt.sh
+++ b/tests/ssl-opt.sh
@@ -1596,6 +1596,8 @@
             -C "! ssl_handshake returned" \
             -S "X509 - Certificate verification failed"
 
+# The "max_int chain" tests assume that MAX_INTERMEDIATE_CA is set to its
+# default value (8)
 run_test    "Authentication: server max_int chain, client default" \
             "$P_SRV crt_file=data_files/dir-maxpath/c09.pem \
                     key_file=data_files/dir-maxpath/09.key" \