8545051c36
This guards against the name constraints check consuming large amounts of CPU time when certificates in the presented chain contain an excessive number of names (specifically subject email names or subject alternative DNS names) and/or name constraints. Name constraints checking compares the names presented in a certificate against the name constraints included in a certificate higher up in the chain using two nested for loops. Move the name constraints check so that it happens after signature verification so peers cannot exploit this using a chain with invalid signatures. Also impose a hard limit on the number of name constraints check loop iterations to further mitigate the issue. Thanks to NCC for finding this issue. Fix written by Martin Kreichgauer. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4393) |
||
|---|---|---|
| .. | ||
| build.info | ||
| by_dir.c | ||
| by_file.c | ||
| t_crl.c | ||
| t_req.c | ||
| t_x509.c | ||
| x509_att.c | ||
| x509_cmp.c | ||
| x509_d2.c | ||
| x509_def.c | ||
| x509_err.c | ||
| x509_ext.c | ||
| x509_lcl.h | ||
| x509_lu.c | ||
| x509_obj.c | ||
| x509_r2x.c | ||
| x509_req.c | ||
| x509_set.c | ||
| x509_trs.c | ||
| x509_txt.c | ||
| x509_v3.c | ||
| x509_vfy.c | ||
| x509_vpm.c | ||
| x509cset.c | ||
| x509name.c | ||
| x509rset.c | ||
| x509spki.c | ||
| x509type.c | ||
| x_all.c | ||
| x_attrib.c | ||
| x_crl.c | ||
| x_exten.c | ||
| x_name.c | ||
| x_pubkey.c | ||
| x_req.c | ||
| x_x509.c | ||
| x_x509a.c | ||