diff --git a/cyassl/error.h b/cyassl/error.h index 8909df6a3..c3b79d0ce 100644 --- a/cyassl/error.h +++ b/cyassl/error.h @@ -100,6 +100,7 @@ enum CyaSSL_ErrorCodes { OCSP_NEED_URL = -265, /* OCSP need an URL for lookup */ OCSP_CERT_UNKNOWN = -266, /* OCSP responder doesn't know */ OCSP_LOOKUP_FAIL = -267, /* OCSP lookup not successful */ + MAX_CHAIN_ERROR = -268, /* max chain depth exceeded */ /* add strings to SetErrorString !!!!! */ /* begin negotiation parameter errors */ diff --git a/cyassl/internal.h b/cyassl/internal.h index 1828da6c5..9e7dfa928 100644 --- a/cyassl/internal.h +++ b/cyassl/internal.h @@ -387,7 +387,7 @@ enum Misc { MAX_EX_DATA = 3, /* allow for three items of ex_data */ MAX_CHAIN_DEPTH = 9, /* max cert chain peer depth, FORTRESS option */ #else - MAX_CHAIN_DEPTH = 4, /* max cert chain peer depth */ + MAX_CHAIN_DEPTH = 6, /* max cert chain peer depth */ #endif MAX_X509_SIZE = 2048, /* max static x509 buffer size */ CERT_MIN_SIZE = 256, /* min PEM cert size with header/footer */ diff --git a/src/internal.c b/src/internal.c index 9b25d09b8..6e106d485 100644 --- a/src/internal.c +++ b/src/internal.c @@ -1586,7 +1586,7 @@ static int DoCertificate(CYASSL* ssl, byte* input, word32* inOutIdx) word32 certSz; if (totalCerts >= MAX_CHAIN_DEPTH) - return BUFFER_E; + return MAX_CHAIN_ERROR; c24to32(&input[i], &certSz); i += CERT_HEADER_SZ; @@ -3558,6 +3558,10 @@ void SetErrorString(int error, char* str) XSTRNCPY(str, "OCSP Responder lookup fail", max); break; + case MAX_CHAIN_ERROR: + XSTRNCPY(str, "Maximum Chain Depth Exceeded", max); + break; + default : XSTRNCPY(str, "unknown error number", max); }