avoid verification loops in trusted store when path building

diff --git a/CHANGES b/CHANGES
index 6157a1ef0db391fe3d9c34f9810821731064d2ff..c75e5147930104d4b45c9aa52b416750cc5e2772 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -4,6 +4,10 @@
 
  Changes between 1.0.1 and 1.1.0  [xx XXX xxxx]
 
+  *) If a candidate issuer certificate is already part of the constructed
+     path ignore it: new debug notification X509_V_ERR_PATH_LOOP for this case.
+     [Steve Henson]
+
   *) Improve forward-security support: add functions
 
        void SSL_CTX_set_not_resumable_session_callback(SSL_CTX *ctx, int (*cb)(SSL *ssl, int is_forward_secure))

diff --git a/crypto/x509/x509_txt.c b/crypto/x509/x509_txt.c
index c44f753c462cb2be7d26e4b1c18eebd6f55a1c4c..9a0911a304a127d564919018622a9981a1d3ea06 100644 (file)
--- a/crypto/x509/x509_txt.c
+++ b/crypto/x509/x509_txt.c
@@ -183,6 +183,8 @@ const char *X509_verify_cert_error_string(long n)
                return("unsupported or invalid name syntax");
        case X509_V_ERR_CRL_PATH_VALIDATION_ERROR:
                return("CRL path validation error");
+       case X509_V_ERR_PATH_LOOP:
+               return("Path Loop");
 
        default:
                BIO_snprintf(buf,sizeof buf,"error number %ld",n);

diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c
index fadf712e4b9a4ea9b24c1044c7545ed06b38901c..64df4d34a122a5bf83d046555cf300a8c7cb71e7 100644 (file)
--- a/crypto/x509/x509_vfy.c
+++ b/crypto/x509/x509_vfy.c
@@ -439,6 +439,21 @@ static int check_issued(X509_STORE_CTX *ctx, X509 *x, X509 *issuer)
 {
        int ret;
        ret = X509_check_issued(issuer, x);
+       if (ret == X509_V_OK)
+               {
+               int i;
+               X509 *ch;
+               for (i = 0; i < sk_X509_num(ctx->chain); i++)
+                       {
+                       ch = sk_X509_value(ctx->chain, i);
+                       if (ch == issuer || !X509_cmp(ch, issuer))
+                               {
+                               ret = X509_V_ERR_PATH_LOOP;
+                               break;
+                               }
+                       }
+               }
+
        if (ret == X509_V_OK)
                return 1;
        /* If we haven't asked for issuer errors don't set ctx */

diff --git a/crypto/x509/x509_vfy.h b/crypto/x509/x509_vfy.h
index 992005f2222d49687a985b1ea39b7a0b18eec168..34f2f113d51ac247ba9bbba61a8fe808a46b7984 100644 (file)
--- a/crypto/x509/x509_vfy.h
+++ b/crypto/x509/x509_vfy.h
@@ -353,6 +353,8 @@ void X509_STORE_CTX_set_depth(X509_STORE_CTX *ctx, int depth);
 #define                X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX        52
 #define                X509_V_ERR_UNSUPPORTED_NAME_SYNTAX              53
 #define                X509_V_ERR_CRL_PATH_VALIDATION_ERROR            54
+/* Another issuer check debug option */
+#define                X509_V_ERR_PATH_LOOP                            55
 
 /* The application is not happy */
 #define                X509_V_ERR_APPLICATION_VERIFICATION             50