From 2b3936e8825efa15eceaa41ba6d3486dfc6ee2c0 Mon Sep 17 00:00:00 2001 From: "Dr. Stephen Henson" Date: Sat, 25 Dec 2010 20:45:59 +0000 Subject: [PATCH] avoid verification loops in trusted store when path building --- CHANGES | 4 ++++ crypto/x509/x509_txt.c | 2 ++ crypto/x509/x509_vfy.c | 15 +++++++++++++++ crypto/x509/x509_vfy.h | 2 ++ 4 files changed, 23 insertions(+) diff --git a/CHANGES b/CHANGES index 6157a1ef0d..c75e514793 100644 --- a/CHANGES +++ b/CHANGES @@ -4,6 +4,10 @@ Changes between 1.0.1 and 1.1.0 [xx XXX xxxx] + *) If a candidate issuer certificate is already part of the constructed + path ignore it: new debug notification X509_V_ERR_PATH_LOOP for this case. + [Steve Henson] + *) Improve forward-security support: add functions void SSL_CTX_set_not_resumable_session_callback(SSL_CTX *ctx, int (*cb)(SSL *ssl, int is_forward_secure)) diff --git a/crypto/x509/x509_txt.c b/crypto/x509/x509_txt.c index c44f753c46..9a0911a304 100644 --- a/crypto/x509/x509_txt.c +++ b/crypto/x509/x509_txt.c @@ -183,6 +183,8 @@ const char *X509_verify_cert_error_string(long n) return("unsupported or invalid name syntax"); case X509_V_ERR_CRL_PATH_VALIDATION_ERROR: return("CRL path validation error"); + case X509_V_ERR_PATH_LOOP: + return("Path Loop"); default: BIO_snprintf(buf,sizeof buf,"error number %ld",n); diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c index fadf712e4b..64df4d34a1 100644 --- a/crypto/x509/x509_vfy.c +++ b/crypto/x509/x509_vfy.c @@ -439,6 +439,21 @@ static int check_issued(X509_STORE_CTX *ctx, X509 *x, X509 *issuer) { int ret; ret = X509_check_issued(issuer, x); + if (ret == X509_V_OK) + { + int i; + X509 *ch; + for (i = 0; i < sk_X509_num(ctx->chain); i++) + { + ch = sk_X509_value(ctx->chain, i); + if (ch == issuer || !X509_cmp(ch, issuer)) + { + ret = X509_V_ERR_PATH_LOOP; + break; + } + } + } + if (ret == X509_V_OK) return 1; /* If we haven't asked for issuer errors don't set ctx */ diff --git a/crypto/x509/x509_vfy.h b/crypto/x509/x509_vfy.h index 992005f222..34f2f113d5 100644 --- a/crypto/x509/x509_vfy.h +++ b/crypto/x509/x509_vfy.h @@ -353,6 +353,8 @@ void X509_STORE_CTX_set_depth(X509_STORE_CTX *ctx, int depth); #define X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX 52 #define X509_V_ERR_UNSUPPORTED_NAME_SYNTAX 53 #define X509_V_ERR_CRL_PATH_VALIDATION_ERROR 54 +/* Another issuer check debug option */ +#define X509_V_ERR_PATH_LOOP 55 /* The application is not happy */ #define X509_V_ERR_APPLICATION_VERIFICATION 50 -- 2.25.1