mirror of
https://github.com/wolfSSL/wolfssl.git
synced 2026-10-24 04:09:07 +03:00
e0fd0c677f
Fenrir 12740: X509_STORE_CTX_set_depth(ctx, 0) was treated as unset and silently got WOLFSSL_X509_STORE_DEFAULT_MAX_DEPTH. - set_depth() now always marks the depth as explicit so 0 means no intermediate CAs are allowed. - An explicit negative depth rejects every chain with CERT_CHAIN_TOO_LONG before any path is built, instead of falling back to the default. - X509_STORE_CTX_init() sets the depth to the default chain max depth. - A positive ctx->depth written directly to the struct (no setter) is still honored. The budget is clamped so INT_MAX cannot overflow it. A trust anchor from X509_STORE_CTX_trusted_stack() or store->certs is found by the same lookup as an untrusted intermediate and cost one extra pass, so explicit depth N only allowed N-1 intermediates there (and depth 0 rejected a leaf issued directly by the anchor). When the budget runs out on a caller-trusted anchor that would end the path (self-issued or PARTIAL_CHAIN), accept it instead of reporting CHAIN_TOO_LONG. An issuer cycle among the untrusted certs (A <- B <- A) was followed until the depth budget ran out, ~2^31 signature checks at INT_MAX. The untrusted-issuer lookup now skips certs already on the path, so the cycle ends the search with UNABLE_TO_GET_ISSUER_CERT_LOCALLY. Adds loop-a/loop-b/loop-leaf fixtures to untrusted_anchor/ for the test. Also fetch the verify callback once in X509_verify_cert() and pass it to X509StoreVerifyCert(), X509StoreCheckPathLen() and the host/IP checks, and factor the PARTIAL_CHAIN test into X509StoreCertIsPartialChain().
74 lines
3.7 KiB
Plaintext
74 lines
3.7 KiB
Plaintext
# vim:ft=automake
|
|
# All paths should be given relative to the root
|
|
#
|
|
|
|
EXTRA_DIST += \
|
|
certs/intermediate/genintcerts.sh \
|
|
certs/intermediate/ca-ecc-bad-aki.der \
|
|
certs/intermediate/ca-ecc-bad-aki.pem \
|
|
certs/intermediate/ca-int-cert.der \
|
|
certs/intermediate/ca-int-cert.pem \
|
|
certs/intermediate/ca-int-ecc-cert.der \
|
|
certs/intermediate/ca-int-ecc-cert.pem \
|
|
certs/intermediate/ca-int-ecc-key.der \
|
|
certs/intermediate/ca-int-ecc-key.pem \
|
|
certs/intermediate/ca-int-key.der \
|
|
certs/intermediate/ca-int-key.pem \
|
|
certs/intermediate/client-chain-alt-ecc.pem \
|
|
certs/intermediate/client-chain-alt.pem \
|
|
certs/intermediate/ca-int2-cert.der \
|
|
certs/intermediate/ca-int2-cert.pem \
|
|
certs/intermediate/ca-int2-ecc-cert.der \
|
|
certs/intermediate/ca-int2-ecc-cert.pem \
|
|
certs/intermediate/ca-int2-ecc-key.der \
|
|
certs/intermediate/ca-int2-ecc-key.pem \
|
|
certs/intermediate/ca-int2-key.der \
|
|
certs/intermediate/ca-int2-key.pem \
|
|
certs/intermediate/client-chain-ecc.der \
|
|
certs/intermediate/client-chain-ecc.pem \
|
|
certs/intermediate/client-chain.der \
|
|
certs/intermediate/client-chain.pem \
|
|
certs/intermediate/client-int-cert.der \
|
|
certs/intermediate/client-int-cert.pem \
|
|
certs/intermediate/client-int-ecc-cert.der \
|
|
certs/intermediate/client-int-ecc-cert.pem \
|
|
certs/intermediate/server-chain-alt-ecc.pem \
|
|
certs/intermediate/server-chain-alt.pem \
|
|
certs/intermediate/server-chain-ecc.der \
|
|
certs/intermediate/server-chain-ecc.pem \
|
|
certs/intermediate/server-chain-short.pem \
|
|
certs/intermediate/server-chain.der \
|
|
certs/intermediate/server-chain.pem \
|
|
certs/intermediate/server-int-cert.der \
|
|
certs/intermediate/server-int-cert.pem \
|
|
certs/intermediate/server-int-ecc-cert.der \
|
|
certs/intermediate/ca_false_intermediate/gentestcert.sh \
|
|
certs/intermediate/ca_false_intermediate/int_ca.key \
|
|
certs/intermediate/ca_false_intermediate/server.key \
|
|
certs/intermediate/ca_false_intermediate/test_ca.key \
|
|
certs/intermediate/ca_false_intermediate/test_ca.pem \
|
|
certs/intermediate/ca_false_intermediate/test_int_not_cacert.pem \
|
|
certs/intermediate/ca_false_intermediate/test_sign_bynoca_srv.pem \
|
|
certs/intermediate/ca_false_intermediate/wolfssl_base.conf \
|
|
certs/intermediate/ca_false_intermediate/wolfssl_srv.conf \
|
|
certs/intermediate/untrusted_anchor/gen_certs.sh \
|
|
certs/intermediate/untrusted_anchor/root-ca-cert.pem \
|
|
certs/intermediate/untrusted_anchor/root-ca-key.pem \
|
|
certs/intermediate/untrusted_anchor/alt-ca-cert.pem \
|
|
certs/intermediate/untrusted_anchor/alt-ca-key.pem \
|
|
certs/intermediate/untrusted_anchor/int-ca-cert.pem \
|
|
certs/intermediate/untrusted_anchor/int-ca-key.pem \
|
|
certs/intermediate/untrusted_anchor/int-ca-tampered-cert.pem \
|
|
certs/intermediate/untrusted_anchor/int-ca2-cert.pem \
|
|
certs/intermediate/untrusted_anchor/int-ca2-key.pem \
|
|
certs/intermediate/untrusted_anchor/leaf-cert.pem \
|
|
certs/intermediate/untrusted_anchor/leaf-key.pem \
|
|
certs/intermediate/untrusted_anchor/leaf-deep-cert.pem \
|
|
certs/intermediate/untrusted_anchor/leaf-deep-key.pem \
|
|
certs/intermediate/untrusted_anchor/loop-a-cert.pem \
|
|
certs/intermediate/untrusted_anchor/loop-a-key.pem \
|
|
certs/intermediate/untrusted_anchor/loop-b-cert.pem \
|
|
certs/intermediate/untrusted_anchor/loop-b-key.pem \
|
|
certs/intermediate/untrusted_anchor/loop-leaf-cert.pem \
|
|
certs/intermediate/untrusted_anchor/loop-leaf-key.pem
|