]> git.ipfire.org Git - thirdparty/squid.git/commit
Handle infinite certificate validation loops caused by OpenSSL bug #3090.
authorChristos Tsantilas <chtsanti@users.sourceforge.net>
Tue, 10 Sep 2013 07:22:44 +0000 (01:22 -0600)
committerAmos Jeffries <squid3@treenet.co.nz>
Tue, 10 Sep 2013 07:22:44 +0000 (01:22 -0600)
commitc943f8b62678779abf589618706174a8aff01f30
treed6d1f598bee747392bdef001020db92acdf2fb4e
parentea94175e683bb13330e66965d49e3147486155af
Handle infinite certificate validation loops caused by OpenSSL bug #3090.

If OpenSSL is stuck in a validation loop, Squid breaks the loop and
triggers a
new custom SQUID_X509_V_ERR_INFINITE_VALIDATION SSL validation error.
That
error cannot be bypassed using sslproxy_cert_error because to break the
loop
Squid has to tell OpenSSL that the certificate is invalid, which
terminates
the SSL connection.

Validation loops exceeding SQUID_CERT_VALIDATION_ITERATION_MAX
iterations
are deemed infinite. That macro is defined to be 16384, but that default
can
be overwritten using CPPFLAGS.

  This is a Measurement Factory project
errors/templates/error-details.txt
src/cf.data.pre
src/globals.h
src/ssl/ErrorDetail.cc
src/ssl/support.cc
src/ssl/support.h