Fix: X509 honor explicit depth 0 - #11440
aidankeefe2022 wants to merge 1 commit into
Conversation
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #11440
Scan targets checked: wolfssl-src, wolfssl-bugs
Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)
This review was generated automatically by Fenrir. Reported findings require changes before merge.
|
b140b07 to
28b8f86
Compare
aidankeefe2022
changed the title
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #11440
Scan targets checked: wolfssl-src, wolfssl-bugs
Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)
This review was generated automatically by Fenrir. Reported findings require changes before merge.
28b8f86 to
a5dec5c
Compare
Fenrir's latest completed scan found no issues; clearing the prior automated change request.
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #11440
Scan targets checked: none
Unchanged since last review (not re-run): wolfssl-src, wolfssl-bugs
Fenrir result: Approved ✅
No new issues found in the changed files.
Advisory only — this automated result does not count as a GitHub approval.
Fenrir's latest completed scan found no issues; clearing the prior automated change request.
…depth Fenrir 12740: X509_STORE_CTX_set_depth(ctx, 0) was treated as unset and silently got WOLFSSL_X509_STORE_DEFAULT_MAX_DEPTH. - set_depth() now always marks the depth as explicit (new depthSet bit), so 0 means no intermediate CAs are allowed. - An explicit negative depth rejects every chain with CERT_CHAIN_TOO_LONG before any path is built, instead of falling back to the default. - X509_STORE_CTX_init() resets the depth, so a reused context no longer keeps a previous limit. - A positive ctx->depth written directly to the struct (no setter) is still honored. The budget is clamped so INT_MAX cannot overflow it. A trust anchor from X509_STORE_CTX_trusted_stack() or store->certs is found by the same lookup as an untrusted intermediate and cost one extra pass, so explicit depth N only allowed N-1 intermediates there (and depth 0 rejected a leaf issued directly by the anchor). When the budget runs out on a caller-trusted anchor that would end the path (self-issued or PARTIAL_CHAIN), accept it instead of reporting CHAIN_TOO_LONG. An issuer cycle among the untrusted certs (A <- B <- A) was followed until the depth budget ran out, ~2^31 signature checks at INT_MAX. The untrusted-issuer lookup now skips certs already on the path, so the cycle ends the search with UNABLE_TO_GET_ISSUER_CERT_LOCALLY. Adds loop-a/loop-b/loop-leaf fixtures to untrusted_anchor/ for the test. Also fetch the verify callback once in X509_verify_cert() and pass it to X509StoreVerifyCert(), X509StoreCheckPathLen() and the host/IP checks, and factor the PARTIAL_CHAIN test into X509StoreCertIsPartialChain().
a5dec5c to
c894c46
Compare
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #11440
Scan targets checked: wolfssl-src, wolfssl-bugs
Fenrir result: Approved ✅
No new issues found in the changed files.
Advisory only — this automated result does not count as a GitHub approval.
|
retest this please |
2 participants
Description
Fenrir 12740: X509_STORE_CTX_set_depth(ctx, 0) was treated as unset and silently go WOLFSSL_X509_STORE_DEFAULT_MAX_DEPTH.
Testing
asserted all behavior changes with test making sure all depth behavior is tested.
Checklist