tree c3351f0573214a5d71b0d0ad05dbede551fca7bd
parent 41ce6e60766a4a92241efa2571f1b5219dc02e9c
author Andres AG <andres.amayagarcia@arm.com> 1481304383 +0000
committer Andres AG <andres.amayagarcia@arm.com> 1484930295 +0000

Fix verify out flags from x509_crt_verify_top()

This change fixes a regression introduced by an earlier commit that
modified x509_crt_verify_top() to ensure that valid certificates
that are after past or future valid in the chain are processed. However
the change introduced a change in behaviour that caused the
verification flags MBEDTLS_X509_BADCERT_EXPIRED and
MBEDTLS_BADCERT_FUTURE to always be set whenever there is a failure in
the verification regardless of the cause.

The fix maintains both behaviours:
  * Ensure that valid certificates after future and past are verified
  * Ensure that the correct verification flags are set.

To do so, a temporary pointer to the first future or past valid
certificate is maintained while traversing the chain. If a truly valid
certificate is found then that one is used, otherwise if no valid
certificate is found and the end of the chain is reached, the program
reverts back to using the future or past valid certificate.