>From c5649a4439636115f3002e93a3158f5cfdd401ab Mon Sep 17 00:00:00 2001
From: Roumen Petrov <openssh@roumenpetrov.info>
Date: Mon, 15 May 2017 20:50:39 +0300
Subject: [PATCH 4/4] pass key chain with X.509 certificates to verify method

also correct hash-dir test
---
 ssh-x509.c                        |  6 +++---
 tests/CA/test-dn_auth_path.sh.inc | 23 +++++++++++++++++++----
 2 files changed, 22 insertions(+), 7 deletions(-)

diff --git a/ssh-x509.c b/ssh-x509.c
index b2781d9..fae1327 100644
--- a/ssh-x509.c
+++ b/ssh-x509.c
@@ -1646,14 +1646,14 @@ ssh_x509key_name(const Key *k) {
 int
 ssh_x509key_verify_cert(const Key *k) {
 	int ret = -1;
-	X509 *x;
+	SSH_X509 *xd;
 
 	if (!x509key_check("verify_cert", k)) goto done;
 
-	x = k->x509_data->cert;
+	xd = k->x509_data;
 
 	if (pssh_x509store_verify_cert != NULL) {
-		ret = pssh_x509store_verify_cert(x, NULL);
+		ret = pssh_x509store_verify_cert(xd->cert, xd->chain);
 	} else {
 		error("%s: pssh_x509store_verify_cert is NULL", __func__);
 	}
diff --git a/tests/CA/test-dn_auth_path.sh.inc b/tests/CA/test-dn_auth_path.sh.inc
index 8d581fb..8edeeee 100644
--- a/tests/CA/test-dn_auth_path.sh.inc
+++ b/tests/CA/test-dn_auth_path.sh.inc
@@ -22,8 +22,10 @@
 # DESCRIPTION: Test client authentication:
 #  - "IdentityFile" contain private key and x509 certificate;
 #  - "AuthorizedKeysFile" contain certificate Subject;
-#  - authorization against only one CA certificate in server x509 store.
-#
+#  - authorization against exact intermediate CA certificate in
+#    server x509 store (legacy public key algorithm);
+#  - authorization against only root CA certificate in
+#    server x509 store (RFC6187 key algorithms).
 
 
 # ===
@@ -47,7 +49,11 @@ testDNautorizations2 () {
 
   creX509AuthorizedKeysFile "${identity_file}" || return $?
 
-  if test "${catype}" = "${type}"; then
+  expect_success=:
+  if $SSH_LEGACY_FORMAT ; then
+    test "$type" != "$catype" && expect_success=false
+  fi
+  if $expect_success ; then
     runTest "${extd}${type}${norm}" \
       "${identity_file}"\
       "" ""
@@ -93,6 +99,13 @@ EOF
       printSeparator
       echo "Begin test with base key_file ${attn}${SSH_CLIENTKEY}${norm} ..."
 
+      #TODO rsa/dsa in RFC6187 format
+      SSH_LEGACY_FORMAT=false
+      case $SSH_CLIENTKEY in
+      testid_ecc*) ;;
+      *) SSH_LEGACY_FORMAT=: ;;
+      esac
+
       if test ! -d "${CRT_TEST_DIR}"; then
         mkdir "$CRT_TEST_DIR" || exit $?
       fi
@@ -104,7 +117,9 @@ EOF
           for level in 0; do
             cre_hash_link "$SSH_CACERTDIR/$CAKEY_PREFIX"-root${level}.crt.pem || exit $?
           done
-          cre_hash_link "$SSH_CACERTDIR/${CAKEY_PREFIX}-${catype}.crt.pem"
+          if $SSH_LEGACY_FORMAT ; then
+            cre_hash_link "$SSH_CACERTDIR/${CAKEY_PREFIX}-${catype}.crt.pem"
+          fi
         ) &&
         do_test_catype; retval=$?
         rm -f "$CRT_TEST_DIR"/*
-- 
2.9.0