diff options
| author | Dr. Stephen Henson <steve@openssl.org> | 2010-12-25 20:45:59 +0000 |
|---|---|---|
| committer | Dr. Stephen Henson <steve@openssl.org> | 2010-12-25 20:45:59 +0000 |
| commit | 2b3936e8825efa15eceaa41ba6d3486dfc6ee2c0 (patch) | |
| tree | 575fc8a86270ba93cb4b4c169699f19240e2f2b1 /crypto/x509 | |
| parent | c596b2ab5b47b00db619ff3b9cba37697ad93679 (diff) | |
avoid verification loops in trusted store when path building
Diffstat (limited to 'crypto/x509')
| -rw-r--r-- | crypto/x509/x509_txt.c | 2 | ||||
| -rw-r--r-- | crypto/x509/x509_vfy.c | 15 | ||||
| -rw-r--r-- | crypto/x509/x509_vfy.h | 2 |
3 files changed, 19 insertions, 0 deletions
diff --git a/crypto/x509/x509_txt.c b/crypto/x509/x509_txt.c index c44f753c46..9a0911a304 100644 --- a/crypto/x509/x509_txt.c +++ b/crypto/x509/x509_txt.c @@ -183,6 +183,8 @@ const char *X509_verify_cert_error_string(long n) return("unsupported or invalid name syntax"); case X509_V_ERR_CRL_PATH_VALIDATION_ERROR: return("CRL path validation error"); + case X509_V_ERR_PATH_LOOP: + return("Path Loop"); default: BIO_snprintf(buf,sizeof buf,"error number %ld",n); diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c index fadf712e4b..64df4d34a1 100644 --- a/crypto/x509/x509_vfy.c +++ b/crypto/x509/x509_vfy.c @@ -440,6 +440,21 @@ static int check_issued(X509_STORE_CTX *ctx, X509 *x, X509 *issuer) int ret; ret = X509_check_issued(issuer, x); if (ret == X509_V_OK) + { + int i; + X509 *ch; + for (i = 0; i < sk_X509_num(ctx->chain); i++) + { + ch = sk_X509_value(ctx->chain, i); + if (ch == issuer || !X509_cmp(ch, issuer)) + { + ret = X509_V_ERR_PATH_LOOP; + break; + } + } + } + + if (ret == X509_V_OK) return 1; /* If we haven't asked for issuer errors don't set ctx */ if (!(ctx->param->flags & X509_V_FLAG_CB_ISSUER_CHECK)) diff --git a/crypto/x509/x509_vfy.h b/crypto/x509/x509_vfy.h index 992005f222..34f2f113d5 100644 --- a/crypto/x509/x509_vfy.h +++ b/crypto/x509/x509_vfy.h @@ -353,6 +353,8 @@ void X509_STORE_CTX_set_depth(X509_STORE_CTX *ctx, int depth); #define X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX 52 #define X509_V_ERR_UNSUPPORTED_NAME_SYNTAX 53 #define X509_V_ERR_CRL_PATH_VALIDATION_ERROR 54 +/* Another issuer check debug option */ +#define X509_V_ERR_PATH_LOOP 55 /* The application is not happy */ #define X509_V_ERR_APPLICATION_VERIFICATION 50 |