diff --git a/src/error.rs b/src/error.rs index 2b7183a4..c450b89f 100644 --- a/src/error.rs +++ b/src/error.rs @@ -115,6 +115,20 @@ pub enum Error { UnsupportedSignatureAlgorithmForPublicKey, } +impl Error { + /// Returns true for errors that should be considered fatal during path building. Errors of + /// this class should halt any further path building and be returned immediately. + #[inline] + pub(crate) fn is_fatal(&self) -> bool { + matches!( + self, + Error::MaximumSignatureChecksExceeded + | Error::MaximumPathBuildCallsExceeded + | Error::MaximumNameConstraintComparisonsExceeded + ) + } +} + impl fmt::Display for Error { fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result { write!(f, "{:?}", self) diff --git a/src/verify_cert.rs b/src/verify_cert.rs index c77c8e5f..cc977cf1 100644 --- a/src/verify_cert.rs +++ b/src/verify_cert.rs @@ -464,9 +464,9 @@ where // If the error is not fatal, then keep going. match f(v) { Ok(()) => return Ok(()), - err @ Err(Error::MaximumSignatureChecksExceeded) - | err @ Err(Error::MaximumPathBuildCallsExceeded) - | err @ Err(Error::MaximumNameConstraintComparisonsExceeded) => return err, + // Fatal errors should halt further looping. + res @ Err(err) if err.is_fatal() => return res, + // Non-fatal errors should allow looping to continue. _ => {} } }