Repository navigation
certman: keep peer intermediates as chain CAs - #1338
Conversation
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #1338
Scan targets checked: wolfssh-src, wolfssh-bugs
Coverage: 1 of 4 in-scope changed file(s) opened by the reviewer; not opened: tests/unit.c, wolfssh/certman.h, wolfssh/internal.h
Fenrir result: Approved ✅
No new issues found in the changed files.
Advisory only — this automated result does not count as a GitHub approval.
Review tier: Lite
7139997 to
4a61a8d
Compare
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #1338
Scan targets checked: none
Unchanged since last review (not re-run): wolfssh-src, wolfssh-bugs
Fenrir result: Approved ✅
No new issues found in the changed files.
Advisory only — this automated result does not count as a GitHub approval.
Review tier: Lite
|
@claude review |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
4a61a8d to
9b93dd6
Compare
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #1338
Scan targets checked: wolfssh-src, wolfssh-bugs
Coverage: 4 of 4 in-scope changed file(s) opened by the reviewer
Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)
This review was generated automatically by Fenrir. Reported findings require changes before merge.
Review tier: Max
94368d0 to
3b25b4a
Compare
VerifyCerts_buffer() loaded every verified cert above the leaf as a trusted root. It now loads an intermediate only when the cert below needs it as issuer, and on wolfSSL 5.8.4 or later keeps it as a WOLFSSL_CHAIN_CA, as TLS does, tagging it once the cert below verifies or fails only on its signature, since the typed load retags matches. - every cert above the leaf must still pass the CA check - use the typed load only without NO_SKID, mapping failures to WS_ codes and logging a failed retag as an error - document the kept intermediates and the strict chain order - test that roots stay roots and a CA loads only for a cert it signs - test that a failed allocation never retags a trusted root and that a bad-signature leaf leaves its CA a chain CA Issue: F-10586
wc_ParseCert() with NO_VERIFY does not look up the signer of a self-issued leaf, so CheckProfile() treats a NULL cert->ca as a profile mismatch instead of dereferencing it. - test a self-issued leaf that reaches the issuer-DN match Issue: F-8862
3b25b4a to
31255e3
Compare
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #1338
Scan targets checked: wolfssh-src, wolfssh-bugs
Coverage: 2 of 3 in-scope changed file(s) opened by the reviewer; not opened: wolfssh/certman.h
Fenrir result: Approved ✅
No new issues found in the changed files.
Advisory only — this automated result does not count as a GitHub approval.
Review tier: Lite
Fenrir's latest completed scan found no issues; clearing the prior automated change request.
wolfSSH_CERTMAN_VerifyCerts_buffer() loads a peer's intermediate only
when the cert below needs it as issuer, and keeps it as a
WOLFSSL_CHAIN_CA on wolfSSL 5.8.4 and later, the same as TLS.
intermediates are cleared with
wolfSSL_CertManagerUnloadIntermediateCerts().
fails with WS_CERT_NO_SIGNER_E. This needs a ChangeLog line.
mismatch instead of dereferencing NULL.
Issue: F-10586, F-8862