diff options
| author | Dr. Stephen Henson <steve@openssl.org> | 2013-07-12 17:35:08 +0100 |
|---|---|---|
| committer | Dr. Stephen Henson <steve@openssl.org> | 2013-07-12 17:48:41 +0100 |
| commit | 4b26645c1a71cf9ce489e4f79fc836760b670ffe (patch) | |
| tree | 715211f01fa50d369b9525a655e226ddc0c53fb3 /crypto | |
| parent | c051cbc83ff13e1dee9951b10255f0b9679ba502 (diff) | |
| download | openssl-4b26645c1a71cf9ce489e4f79fc836760b670ffe.zip openssl-4b26645c1a71cf9ce489e4f79fc836760b670ffe.tar.gz openssl-4b26645c1a71cf9ce489e4f79fc836760b670ffe.tar.bz2 | |
Fix verify loop with CRL checking.
PR #3090
Reported by: Franck Youssef <fry@open.ch>
If no new reason codes are obtained after checking a CRL exit with an
error to avoid repeatedly checking the same CRL.
This will only happen if verify errors such as invalid CRL scope are
overridden in a callback.
Diffstat (limited to 'crypto')
| -rw-r--r-- | crypto/x509/x509_vfy.c | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c index 5f6687e..fe7ca83 100644 --- a/crypto/x509/x509_vfy.c +++ b/crypto/x509/x509_vfy.c @@ -838,6 +838,7 @@ static int check_cert(X509_STORE_CTX *ctx) X509_CRL *crl = NULL, *dcrl = NULL; X509 *x; int ok, cnum; + unsigned int last_reasons; cnum = ctx->error_depth; x = sk_X509_value(ctx->chain, cnum); ctx->current_cert = x; @@ -846,6 +847,7 @@ static int check_cert(X509_STORE_CTX *ctx) ctx->current_reasons = 0; while (ctx->current_reasons != CRLDP_ALL_REASONS) { + last_reasons = ctx->current_reasons; /* Try to retrieve relevant CRL */ if (ctx->get_crl) ok = ctx->get_crl(ctx, &crl, x); @@ -889,6 +891,15 @@ static int check_cert(X509_STORE_CTX *ctx) X509_CRL_free(dcrl); crl = NULL; dcrl = NULL; + /* If reasons not updated we wont get anywhere by + * another iteration, so exit loop. + */ + if (last_reasons == ctx->current_reasons) + { + ctx->error = X509_V_ERR_UNABLE_TO_GET_CRL; + ok = ctx->verify_cb(0, ctx); + goto err; + } } err: X509_CRL_free(crl); |