From ffce5db1b7280987e746fe6bfb9444d1303741f3 Mon Sep 17 00:00:00 2001
From: Andreas Steffen <andreas.steffen@strongswan.org>
Date: Fri, 21 Mar 2008 19:07:12 +0000
Subject: [PATCH] self-signed certificates were not marked by x509_cert.c

---
 src/libstrongswan/plugins/x509/x509_cert.c | 36 +++++++++++++---------
 1 file changed, 22 insertions(+), 14 deletions(-)

diff --git a/src/libstrongswan/plugins/x509/x509_cert.c b/src/libstrongswan/plugins/x509/x509_cert.c
index a1d410982..09bc3e0ef 100644
--- a/src/libstrongswan/plugins/x509/x509_cert.c
+++ b/src/libstrongswan/plugins/x509/x509_cert.c
@@ -940,22 +940,27 @@ static bool issued_by(private_x509_cert_t *this, certificate_t *issuer,
 	bool valid;
 	x509_t *x509 = (x509_t*)issuer;
 	
-	if (&this->public.interface.interface == issuer &&
-		(this->flags & X509_SELF_SIGNED))
+	if (&this->public.interface.interface == issuer)
 	{
-		return TRUE;
+		if (this->flags & X509_SELF_SIGNED)
+		{
+			return TRUE;
+		}
 	}
-	if (issuer->get_type(issuer) != CERT_X509)
+	else
 	{
-		return FALSE;
-	}
-	if (!this->issuer->equals(this->issuer, issuer->get_subject(issuer)))
-	{
-		return FALSE;
-	}
-	if (!(x509->get_flags(x509) & X509_CA))
-	{
-		return FALSE;
+		if (issuer->get_type(issuer) != CERT_X509)
+		{
+			return FALSE;
+		}
+		if (!this->issuer->equals(this->issuer, issuer->get_subject(issuer)))
+		{
+			return FALSE;
+		}
+		if (!(x509->get_flags(x509) & X509_CA))
+		{
+			return FALSE;
+		}
 	}
 	if (!sigcheck)
 	{
@@ -1202,7 +1207,10 @@ static private_x509_cert_t *load(chunk_t chunk)
 		destroy(this);
 		return NULL;
 	}
-	if (issued_by(this, &this->public.interface.interface, FALSE))
+	
+	/* check if the certificate self-signed */
+	if (this->subject->equals(this->subject, this->issuer) &&
+		issued_by(this, &this->public.interface.interface, TRUE))
 	{
 		this->flags |= X509_SELF_SIGNED;
 	}