x509-cert: accept v1 CRLs (TBSCertList.version is OPTIONAL) - #2445
Open
yuxi-liu-wired wants to merge 1 commit into
Open
yuxi-liu-wired wants to merge 1 commit into
yuxi-liu-wired wants to merge 1 commit into
Conversation
RFC 5280 Section 5.1 defines `version Version OPTIONAL -- if present, MUST be v2`, as the doc comment on `TbsCertList` already quotes. v1 CRLs omit the field. `TbsCertList` declared it as a required field, so every v1 CRL failed to decode with "expected INTEGER, got SEQUENCE". pyca/cryptography and OpenSSL accept them. Mark it `#[asn1(default = "Default::default")]` (`Version::V1`), as `TbsCertificate` does for its version. A missing version decodes as `V1`, `V1` is omitted when encoding (so v1 CRLs re-encode unchanged), and v2 CRLs, including the ones the CRL builder produces, keep their explicit `INTEGER 1`. Found by fuzzing CRL decoding against pyca/cryptography.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
RFC 5280 Section 5.1:
The doc comment on
TbsCertListquotes this, but the field is declared as a requiredVersion. So every v1 CRL, which omits the field, fails to decode:pyca/cryptography and OpenSSL both accept these CRLs (x509-parser's test assets include one).
Fix: mark the field
#[asn1(default = "Default::default")], so it defaults toVersion::V1, asTbsCertificatealready does for itsversion. With that:V1V1is omitted when encoding, so v1 CRLs re-encode to the same bytesCrlBuilder, keep their explicitINTEGER 1decode_v1_crl_without_versionintests/crl.rscovers both cases and fails on master, andbuilder_crlstill passes. The x509-cert CI steps (--no-default-features, default,--features arbitrary/hazmat/sct, the feature powerset,--all-featuresin debug and release, on stable and 1.85),cargo fmt --checkandcargo +1.90.0 clippy --all-features --testsall pass.Found by fuzzing CRL decoding against pyca/cryptography. This PR was produced by AI agents (Claude), from the fuzzing and the fix through to this description.