Commit 328f36c5 authored by Rob Percival's avatar Rob Percival Committed by Rich Salz
Browse files

Do not display a CT log error message if CT validation is disabled 



Reviewed-by: default avatarEmilia Käsper <emilia@openssl.org>
Reviewed-by: default avatarRich Salz <rsalz@openssl.org>
parent 60b350a3

apps/apps.c

+1 −5
Original line number Diff line number Diff line
@@ -238,11 +238,7 @@ int ctx_set_verify_locations(SSL_CTX *ctx, const char *CAfile, 
int ctx_set_ctlog_list_file(SSL_CTX *ctx, const char *path)

{

    if (path == NULL) {

        if (SSL_CTX_set_default_ctlog_list_file(ctx) <= 0) {

            BIO_puts(bio_err, "Failed to load default Certificate Transparency "

                     "log list\n");

        }

        return 1; /* Do not treat failure to load the default as an error */

        return SSL_CTX_set_default_ctlog_list_file(ctx);

    }



    return SSL_CTX_set_ctlog_list_file(ctx, path);

apps/s_client.c

+12 −2
Original line number Diff line number Diff line
@@ -1670,9 +1670,19 @@ int s_client_main(int argc, char **argv) 
    }



    if (!ctx_set_ctlog_list_file(ctx, ctlog_file)) {

        if (ct_validation != NULL) {

            ERR_print_errors(bio_err);

            goto end;

        }



        /*

         * If CT validation is not enabled, the log list isn't needed so don't

         * show errors or abort. We try to load it regardless because then we

         * can show the names of the logs any SCTs came from (SCTs may be seen

         * even with validation disabled).

         */

        ERR_clear_error();

    }

#endif



    SSL_CTX_set_verify(ctx, verify, verify_callback);

doc/ssl/SSL_CTX_set_ctlog_list_file.pod

+0 −3
Original line number Diff line number Diff line
@@ -37,9 +37,6 @@ The expected format of the log list file is: 
These functions will not clear the existing CT log list - it will be appended

to.



SSL_CTX_set_default_ctlog_list_file() will not report errors if it fails for

any reason. Use SSL_CTX_set_ctlog_list_file() if you want errors to be reported.



If an error occurs whilst parsing a particular log entry in the file, that log

entry will be skipped.

ssl/ssl_lib.c

+1 −5
Original line number Diff line number Diff line
@@ -4143,11 +4143,7 @@ end: 


int SSL_CTX_set_default_ctlog_list_file(SSL_CTX *ctx)

{

    int ret = CTLOG_STORE_load_default_file(ctx->ctlog_store);



    /* Clear any errors if the default file does not exist */

    ERR_clear_error();

    return ret;

    return CTLOG_STORE_load_default_file(ctx->ctlog_store);

}



int SSL_CTX_set_ctlog_list_file(SSL_CTX *ctx, const char *path)