Repository navigation
fix(crl): chain the static revoked list for list walkers - #11846
MarkAtwood wants to merge 1 commit into
Conversation
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
|
| XFILE fp = XBADFILE; | ||
| int i; | ||
| byte serial[4]; | ||
| #if defined(CRL_STATIC_REVOKED_LIST) && CRL_MAX_REVOKED_CERTS < 1024 |
There was a problem hiding this comment.
I don't understand this 1024 limit. internal.h has this logic:
#ifdef CRL_STATIC_REVOKED_LIST
#ifndef CRL_MAX_REVOKED_CERTS
#define CRL_MAX_REVOKED_CERTS 4
#elif CRL_MAX_REVOKED_CERTS > 22000
#error CRL_MAX_REVOKED_CERTS too big, max is 22000
#endif
#endif
There was a problem hiding this comment.
1024 isn't a library limit, it's how many entries this test has always added. the static array only holds CRL_MAX_REVOKED_CERTS so the loop stops there when that's smaller, reworded the comment to say that
| "configure": ["--enable-postauth", "--enable-sessioncerts"]}, | ||
| {"name": "all-crl-static-revoked-list", | ||
| "comment": "CRL_STATIC_REVOKED_LIST swaps the revoked cert linked list for a fixed sorted array. Nothing else in this matrix defines it, so the static list tests in tests/api/test_certman.c and the compat layer CRL code on the array (print, get_REVOKED, CRL generation) are built nowhere else.", | ||
| "configure": ["--enable-all", "CPPFLAGS=-DCRL_STATIC_REVOKED_LIST"]} |
There was a problem hiding this comment.
The default value is #define CRL_MAX_REVOKED_CERTS 4 should we also test with the 1024 limit??
There was a problem hiding this comment.
yes, added all-crl-static-revoked-list-1024, so sign_large adds all 1024 and then checks the next add gets MEMORY_E. kept the default 4 entry too. passes make check, and the api tests under asan+ubsan, locally
c438241 to
07b50ae
Compare
fixes #11845. with CRL_STATIC_REVOKED_LIST the revoked certs live in a fixed sorted array, but wc_MakeCRL_ex, X509_CRL_print and X509_CRL_get_REVOKED walk them through
next, which nothing sets for the array, and X509_CRL_add_revoked didn't compile.tested with asan+ubsan, full unit.test: --enable-all + CRL_STATIC_REVOKED_LIST 0 failed, plain --enable-all 0 failed. with master's crl.c the new check fails (get_REVOKED 1, wants 3). a 2 entry CRL from
openssl ca -gencrlprints both entries now, it segfaulted before.touches the same function as #10798, whichever lands second needs a rebase.