Allow X509 certificate chains where we trust a certificate in the middle of the chain.

runtime/bin/secure_socket.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "bin/secure_socket.h"
 
 #include <errno.h>
 #include <fcntl.h>
 #include <sys/stat.h>
 #include <stdio.h>
@@ skipping 877 matching lines @@
   if (is_server_) {
     // Do not request a client certificate.
     // TODO(24069): Allow server to request a client certificate, when desired.
     SSL_set_verify(ssl_, SSL_VERIFY_NONE, NULL);
   } else {
     SetAlpnProtocolList(protocols_handle, ssl_, NULL, false);
     // Sets the hostname in the certificate-checking object, so it is checked
     // against the certificate presented by the server.
     X509_VERIFY_PARAM* certificate_checking_parameters = SSL_get0_param(ssl_);
     hostname_ = strdup(hostname);
+    X509_VERIFY_PARAM_set_flags(certificate_checking_parameters,
+                                X509_V_FLAG_PARTIAL_CHAIN |
+                                X509_V_FLAG_TRUSTED_FIRST);
     X509_VERIFY_PARAM_set_hostflags(certificate_checking_parameters, 0);
     X509_VERIFY_PARAM_set1_host(certificate_checking_parameters,
                                 hostname_, strlen(hostname_));
     // TODO(24225) Check return value of set1_host().
     // TODO(24186) free hostname_ if it is not freed when SSL is destroyed.
     // otherwise, make it a local variable, not a instance field.
   }
   // Make the connection:
   if (is_server_) {
     status = SSL_accept(ssl_);
@@ skipping 42 matching lines @@
   if (callback_error != NULL) {
     // The SSL_do_handshake will try performing a handshake and might call
     // a CertificateCallback. If the certificate validation
     // failed the 'callback_error" will be set by the certificateCallback
     // logic and we propagate the error"
     Dart_PropagateError(callback_error);
   }
   if (SSL_LOG_STATUS) Log::Print("SSL_handshake status: %d\n", status);
   if (status != 1) {
     error = SSL_get_error(ssl_, status);
-    if (SSL_LOG_STATUS) Log::Print("ERROR: %d\n", error);
-    ERR_print_errors_cb(printErrorCallback, NULL);
+    if (SSL_LOG_STATUS) {
+      Log::Print("ERROR: %d\n", error);
+      ERR_print_errors_cb(printErrorCallback, NULL);
+    }
   }
   if (status == 1) {
     if (in_handshake_) {
       // TODO(24071): Check return value of SSL_get_verify_result, this
       //    should give us the hostname check.
       int result = SSL_get_verify_result(ssl_);
       if (SSL_LOG_STATUS) {
         Log::Print("Handshake verification status: %d\n", result);
         X509* peer_certificate = SSL_get_peer_certificate(ssl_);
         if (peer_certificate == NULL) {
@@ skipping 149 matching lines @@
     } else {
       if (SSL_LOG_DATA) Log::Print(
           "WriteEncrypted  BIO_read wrote %d bytes\n", bytes_processed);
     }
   }
   return bytes_processed;
 }
 
 }  // namespace bin
 }  // namespace dart