5 files changed, 50 insertions, 39 deletions
diff --git a/src/sbearssl/deps-lib/sbearssl b/src/sbearssl/deps-lib/sbearssl
index ca68ead..cab0e36 100644
--- a/src/sbearssl/deps-lib/sbearssl
+++ b/src/sbearssl/deps-lib/sbearssl
@@ -53,6 +53,7 @@ sbearssl_x500_from_ta.o
 sbearssl_x500_name_len.o
 sbearssl_x509_minimal_set_tai.o
 sbearssl_x509_small_init_full.o
+sbearssl_x509_small_init_full_options.o
 sbearssl_x509_small_vtable.o
 sbearssl_dayseconds_from_tai.o
 sbearssl_tai_from_dayseconds.o
diff --git a/src/sbearssl/sbearssl_client_init_and_run.c b/src/sbearssl/sbearssl_client_init_and_run.c
index 82c3ff3..5dc764f 100644
--- a/src/sbearssl/sbearssl_client_init_and_run.c
+++ b/src/sbearssl/sbearssl_client_init_and_run.c
@@ -45,7 +45,7 @@ void sbearssl_client_init_and_run (int *fds, tain const *tto, uint32_t preoption
       br_x509_minimal_context dummy ; /* wasteful but the only simple API we have */
       br_ssl_client_init_full(&cc, &dummy, btas, n) ;
     }
-    sbearssl_x509_small_init_full(&xc, btas, n, &cbarg->eedn, &cbarg->eltstatus, cbarg->eehash) ;
+    sbearssl_x509_small_init_full_options(&xc, btas, n, &cbarg->eedn, &cbarg->eltstatus, cbarg->eehash, !!(preoptions & 2)) ;
     if (!sbearssl_x509_small_set_tain_g(&xc))
       strerr_diefu1sys(111, "initialize validation time") ;
     br_ssl_engine_set_x509(&cc.eng, &xc.vtable) ;
diff --git a/src/sbearssl/sbearssl_x509_small_init_full.c b/src/sbearssl/sbearssl_x509_small_init_full.c
index aece45c..1ed879f 100644
--- a/src/sbearssl/sbearssl_x509_small_init_full.c
+++ b/src/sbearssl/sbearssl_x509_small_init_full.c
@@ -1,45 +1,8 @@
 /* ISC license. */
 
-#include <stddef.h>
-#include <stdint.h>
-
-#include <bearssl.h>
-
-#include <skalibs/tai.h>
-
 #include <s6-networking/sbearssl.h>
 
-struct eltinfo_s
-{
-  size_t offset ;
-  size_t size ;
-  unsigned char oid[4] ;
-} ;
-
-static struct eltinfo_s const eltinfo[6] =
-{
-  { .offset = offsetof(sbearssl_dn, c),  .size = sizeof(((sbearssl_dn *)0)->c),  .oid = "\x03\x55\x04\x06" },
-  { .offset = offsetof(sbearssl_dn, st), .size = sizeof(((sbearssl_dn *)0)->st), .oid = "\x03\x55\x04\x08" },
-  { .offset = offsetof(sbearssl_dn, l),  .size = sizeof(((sbearssl_dn *)0)->l),  .oid = "\x03\x55\x04\x07" },
-  { .offset = offsetof(sbearssl_dn, o),  .size = sizeof(((sbearssl_dn *)0)->o),  .oid = "\x03\x55\x04\x0a" },
-  { .offset = offsetof(sbearssl_dn, ou), .size = sizeof(((sbearssl_dn *)0)->ou), .oid = "\x03\x55\x04\x0b" },
-  { .offset = offsetof(sbearssl_dn, cn), .size = sizeof(((sbearssl_dn *)0)->cn), .oid = "\x03\x55\x04\x03" }
-} ;
-
 void sbearssl_x509_small_init_full (sbearssl_x509_small_context *ctx, br_x509_trust_anchor *btas, size_t n, sbearssl_dn *eedn, uint8_t *eltstatus, char *eehash)
 {
-  ctx->vtable = &sbearssl_x509_small_vtable ;
-  br_x509_minimal_init_full(&ctx->minimal, btas, n) ;
-#ifdef BR_FEATURE_X509_TIME_CALLBACK
-  br_x509_minimal_set_time_callback(&ctx->minimal, tain_secp(&STAMP), &sbearssl_x509_time_check) ;
-#endif
-  for (unsigned int i = 0 ; i < 6 ; i++)
-  {
-    ctx->elts[i].oid = eltinfo[i].oid ;
-    ctx->elts[i].buf = (char *)eedn + eltinfo[i].offset ;
-    ctx->elts[i].len = eltinfo[i].size ;
-  }
-  br_x509_minimal_set_name_elements(&ctx->minimal, ctx->elts, 6) ;
-  ctx->eltstatus = eltstatus ;
-  ctx->eehash = eehash ;
+  return sbearssl_x509_small_init_full_options(ctx, btas, n, eedn, eltstatus, eehash, 0) ;
 }
diff --git a/src/sbearssl/sbearssl_x509_small_init_full_options.c b/src/sbearssl/sbearssl_x509_small_init_full_options.c
new file mode 100644
index 0000000..ca8069b
--- /dev/null
+++ b/src/sbearssl/sbearssl_x509_small_init_full_options.c
@@ -0,0 +1,46 @@
+/* ISC license. */
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include <bearssl.h>
+
+#include <skalibs/tai.h>
+
+#include <s6-networking/sbearssl.h>
+
+struct eltinfo_s
+{
+  size_t offset ;
+  size_t size ;
+  unsigned char oid[4] ;
+} ;
+
+static struct eltinfo_s const eltinfo[6] =
+{
+  { .offset = offsetof(sbearssl_dn, c),  .size = sizeof(((sbearssl_dn *)0)->c),  .oid = "\x03\x55\x04\x06" },
+  { .offset = offsetof(sbearssl_dn, st), .size = sizeof(((sbearssl_dn *)0)->st), .oid = "\x03\x55\x04\x08" },
+  { .offset = offsetof(sbearssl_dn, l),  .size = sizeof(((sbearssl_dn *)0)->l),  .oid = "\x03\x55\x04\x07" },
+  { .offset = offsetof(sbearssl_dn, o),  .size = sizeof(((sbearssl_dn *)0)->o),  .oid = "\x03\x55\x04\x0a" },
+  { .offset = offsetof(sbearssl_dn, ou), .size = sizeof(((sbearssl_dn *)0)->ou), .oid = "\x03\x55\x04\x0b" },
+  { .offset = offsetof(sbearssl_dn, cn), .size = sizeof(((sbearssl_dn *)0)->cn), .oid = "\x03\x55\x04\x03" }
+} ;
+
+void sbearssl_x509_small_init_full_options (sbearssl_x509_small_context *ctx, br_x509_trust_anchor *btas, size_t n, sbearssl_dn *eedn, uint8_t *eltstatus, char *eehash, uint32_t flags)
+{
+  ctx->vtable = &sbearssl_x509_small_vtable ;
+  br_x509_minimal_init_full(&ctx->minimal, btas, n) ;
+#ifdef BR_FEATURE_X509_TIME_CALLBACK
+  br_x509_minimal_set_time_callback(&ctx->minimal, tain_secp(&STAMP), &sbearssl_x509_time_check) ;
+#endif
+  for (unsigned int i = 0 ; i < 6 ; i++)
+  {
+    ctx->elts[i].oid = eltinfo[i].oid ;
+    ctx->elts[i].buf = (char *)eedn + eltinfo[i].offset ;
+    ctx->elts[i].len = eltinfo[i].size ;
+  }
+  br_x509_minimal_set_name_elements(&ctx->minimal, ctx->elts, 6) ;
+  ctx->eltstatus = eltstatus ;
+  ctx->eehash = eehash ;
+  ctx->flags = flags ;
+}
diff --git a/src/sbearssl/sbearssl_x509_small_vtable.c b/src/sbearssl/sbearssl_x509_small_vtable.c
index 3b39055..951290a 100644
--- a/src/sbearssl/sbearssl_x509_small_vtable.c
+++ b/src/sbearssl/sbearssl_x509_small_vtable.c
@@ -43,6 +43,7 @@ static unsigned int end_chain (br_x509_class const **c)
 {
   sbearssl_x509_small_context *ctx = INSTANCE(c) ;
   unsigned int r = ctx->minimal.vtable->end_chain(&ctx->minimal.vtable) ;
+  if (ctx->flags & 1 && r == BR_ERR_X509_NOT_TRUSTED) r = 0 ;
   if (!r)
   {
     uint8_t mask = 1 ;