Open
Conversation
There was a problem hiding this comment.
Pull request overview
Adds a new X.509 path validation test case designed to exercise DFS certificate path construction when many alternative intermediate paths are possible (no AKIDs, up to 49 candidate paths).
Changes:
- Add a new
x509_path_buildingtest that loads a synthetic hierarchy (root + 2 intermediate layers) and validates multiple end-entity certs against expected outcomes. - Add the certificate corpus for the new test (root, 7× level2 intermediates, 7× level1 intermediates, 7× end-entity certs) plus an
expected.txtresults file.
Reviewed changes
Copilot reviewed 24 out of 24 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| src/tests/test_x509_path.cpp | Registers and implements the new DFS-heavy certificate path building test. |
| src/tests/data/x509/path_building/root.pem | Root CA certificate for the new path-building test corpus. |
| src/tests/data/x509/path_building/level2_0.pem | Level-2 intermediate CA certificate (test corpus). |
| src/tests/data/x509/path_building/level2_1.pem | Level-2 intermediate CA certificate (test corpus). |
| src/tests/data/x509/path_building/level2_2.pem | Level-2 intermediate CA certificate (test corpus). |
| src/tests/data/x509/path_building/level2_3.pem | Level-2 intermediate CA certificate (test corpus). |
| src/tests/data/x509/path_building/level2_4.pem | Level-2 intermediate CA certificate (test corpus). |
| src/tests/data/x509/path_building/level2_5.pem | Level-2 intermediate CA certificate (test corpus). |
| src/tests/data/x509/path_building/level2_6.pem | Level-2 intermediate CA certificate (test corpus). |
| src/tests/data/x509/path_building/level1_0.pem | Level-1 intermediate CA certificate (test corpus). |
| src/tests/data/x509/path_building/level1_1.pem | Level-1 intermediate CA certificate (test corpus). |
| src/tests/data/x509/path_building/level1_2.pem | Level-1 intermediate CA certificate (test corpus). |
| src/tests/data/x509/path_building/level1_3.pem | Level-1 intermediate CA certificate (test corpus). |
| src/tests/data/x509/path_building/level1_4.pem | Level-1 intermediate CA certificate (test corpus). |
| src/tests/data/x509/path_building/level1_5.pem | Level-1 intermediate CA certificate (test corpus). |
| src/tests/data/x509/path_building/level1_6.pem | Level-1 intermediate CA certificate (test corpus). |
| src/tests/data/x509/path_building/end01.pem | End-entity certificate used for DFS path building validation. |
| src/tests/data/x509/path_building/end02.pem | End-entity certificate used for DFS path building validation. |
| src/tests/data/x509/path_building/end03.pem | End-entity certificate used for DFS path building validation. |
| src/tests/data/x509/path_building/end04.pem | End-entity certificate used for DFS path building validation. |
| src/tests/data/x509/path_building/end05.pem | End-entity certificate used for DFS path building validation. |
| src/tests/data/x509/path_building/end06.pem | End-entity certificate used for DFS path building validation. |
| src/tests/data/x509/path_building/end07.pem | End-entity certificate used for DFS path building validation. |
| src/tests/data/x509/path_building/expected.txt | Expected verification results for the new test cases. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
The end entity certificates are each signed by one of the level1 7 intermediates, and each level1 intermediate is signed by one of the 7 level2 intermediates. No AKIDs are available to guide the path generation, thus as many as 49 possible paths must be checked before a valid path is found.
randombit
force-pushed
the
jack/x509-path-dfs-test
branch
from
e2d5e03 to
77dd869
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The end entity certificates are each signed by one of the level1 7 intermediates, and each level1 intermediate is signed by one of the 7 level2 intermediates. No AKIDs are available to guide the path generation, thus as many as 49 possible paths must be checked before a valid path is found.