Fenrir 12740: X509_STORE_CTX_set_depth(ctx, 0) was treated as unset
and silently got WOLFSSL_X509_STORE_DEFAULT_MAX_DEPTH.
- set_depth() now always marks the depth as explicit
so 0 means no intermediate CAs are allowed.
- An explicit negative depth rejects every chain with
CERT_CHAIN_TOO_LONG before any path is built, instead of falling
back to the default.
- X509_STORE_CTX_init() sets the depth to the default chain max depth.
- A positive ctx->depth written directly to the struct (no setter) is
still honored. The budget is clamped so INT_MAX cannot overflow it.
A trust anchor from X509_STORE_CTX_trusted_stack() or store->certs is
found by the same lookup as an untrusted intermediate and cost one extra
pass, so explicit depth N only allowed N-1 intermediates there (and
depth 0 rejected a leaf issued directly by the anchor). When the budget
runs out on a caller-trusted anchor that would end the path (self-issued
or PARTIAL_CHAIN), accept it instead of reporting CHAIN_TOO_LONG.
An issuer cycle among the untrusted certs (A <- B <- A) was followed
until the depth budget ran out, ~2^31 signature checks at INT_MAX. The
untrusted-issuer lookup now skips certs already on the path, so the
cycle ends the search with UNABLE_TO_GET_ISSUER_CERT_LOCALLY. Adds
loop-a/loop-b/loop-leaf fixtures to untrusted_anchor/ for the test.
Also fetch the verify callback once in X509_verify_cert() and pass it
to X509StoreVerifyCert(), X509StoreCheckPathLen() and the host/IP
checks, and factor the PARTIAL_CHAIN test into
X509StoreCertIsPartialChain().
Ensure caller-supplied intermediate certificates cannot terminate the
chain during compatibility-layer verification; a path must reach a
configured trust anchor. Add a regression test and supporting certs.
- Regen CRL's as most of them are expired
- certs/crl/extra-crls/ca-int-cert-revoked.pem: CRL that revokes certs/intermediate/ca-int-cert.pem signed by certs/ca-cert.pem
- Add CheckCertCRL_ex API to not depend on DecodedCert
- CheckCertCRLList: accept raw serial or hashed version to work with Signers
- Add XELEM_CNT to simplify pre-proc element counting
* Added ECC and RSA intermediate CA's and server/client chain certificates for testing.
* Enhanced suites test to support expected fail arg `-H exitWithRet` in any test .conf file.
* Added new `test-altchains.conf` for testing with `WOLFSSL_ALT_CERT_CHAINS` defined.
* Added new `test-chains` for testing chains.
* Added new `test-dhprime.conf` for DH prime check tests.
* Added new `test-trustedpeer.conf` for testing `WOLFSSL_TRUST_PEER_CERT`.
* Refactor to add `-2` to disable DH prime check by default (except for new test-dhprime.conf).
* Added ability to run a specific test.conf file using syntax like `./tests/unit.test tests/test-altchains.conf`.
