Repository navigation
Conversation
Reject auxiliary anyExtendedKeyUsage rejection in direct COMPAT trust before applying the existing self-signed fallback. Preserve obj_trust() fallback flag semantics and purpose-specific auxiliary behavior. Add CLI and API regression coverage for crlsign and ocsphelper, partial-chain anchors, auxiliary states and initialization paths. The exact model identifier used by the AI assistant is unavailable. Fixes: openssl#32365 Assisted-by: OpenAI Codex:unknown
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Honour auxiliary anyExtendedKeyUsage rejection in direct X509_TRUST_COMPAT checks before the existing self-signed fallback. This fixes crlsign and ocsphelper accepting explicitly rejected anchors, including partial-chain anchors. Fixes #32365.
The production change adds 15 lines. The non-NULL trust guard preserves obj_trust() fallback flag semantics. Purpose-specific rejections, positive auxiliary trust and purpose-to-trust initialization remain unchanged. This does not make every trust mode universally honour reject-all. The shared callback also affects CRMF cmKGA; no dedicated cmKGA fixture was added.
Regression coverage includes 23 new CLI assertions, 16 direct COMPAT combinations with additional NO_SS_COMPAT checks, raw-OID fallback controls, and 48 verification combinations across auxiliary states, both purposes and three initialization paths.
Validation on Linux x86_64 with the default shared configuration and --strict-warnings: final regressions fail as expected without the fix; the strict build and full configured suite pass (407 recipes, 3,729 recipe tests, 29 normal skip lines). clang-format 21.1.6, git diff --check, clean-base patch application and source equality checks pass. Documentation checks pass; the out-of-tree environment scan uses its filesystem fallback.
These are harness/recipe counts, not every nested assertion. Sanitizers, FIPS-enabled builds, other platforms, cross-version builds and upstream CI remain untested.
Prepared with OpenAI Codex assistance; the exact model identifier is unavailable and disclosed as unknown. I have completed human review of the patch and signed the ICLA. I take responsibility for this contribution.