crypto/x509: disallow setting MaxPathLen without IsCA

Fixes #38216

Change-Id: I3222abe2153abb4cbfa65a4825c153ce128f56a0
Reviewed-on: https://go-review.googlesource.com/c/go/+/228777
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>

diff --git a/src/crypto/x509/x509.go b/src/crypto/x509/x509.go
index 6d03a129f8ed9d6d2cbaf5ff08e351089d0dc69c..ecf44071cffa2fc20084fafbcfd13ca3e71da1ea 100644 (file)
--- a/src/crypto/x509/x509.go
+++ b/src/crypto/x509/x509.go
@@ -2100,6 +2100,10 @@ func CreateCertificate(rand io.Reader, template, parent *Certificate, pub, priv
                return nil, errors.New("x509: no SerialNumber given")
        }
 
+       if template.BasicConstraintsValid && !template.IsCA && (template.MaxPathLen != 0 || template.MaxPathLenZero) {
+               return nil, errors.New("x509: only CAs are allowed to specify MaxPathLen")
+       }
+
        hashFunc, signatureAlgorithm, err := signingParamsForPublicKey(key.Public(), template.SignatureAlgorithm)
        if err != nil {
                return nil, err

diff --git a/src/crypto/x509/x509_test.go b/src/crypto/x509/x509_test.go
index bbb1f8d4f11047f356e67a8fb240d8c70c953058..05bade5a8f31ad55ca7073f4b9fe125a2776743a 100644 (file)
--- a/src/crypto/x509/x509_test.go
+++ b/src/crypto/x509/x509_test.go
@@ -1645,6 +1645,41 @@ func serialiseAndParse(t *testing.T, template *Certificate) *Certificate {
        return cert
 }
 
+func TestMaxPathLenNotCA(t *testing.T) {
+       template := &Certificate{
+               SerialNumber: big.NewInt(1),
+               Subject: pkix.Name{
+                       CommonName: "Σ Acme Co",
+               },
+               NotBefore: time.Unix(1000, 0),
+               NotAfter:  time.Unix(100000, 0),
+
+               BasicConstraintsValid: true,
+               IsCA:                  false,
+       }
+       cert := serialiseAndParse(t, template)
+       if m := cert.MaxPathLen; m != -1 {
+               t.Errorf("MaxPathLen should be -1 when IsCa is false, got %d", m)
+       }
+
+       template.MaxPathLen = 5
+       if _, err := CreateCertificate(rand.Reader, template, template, &testPrivateKey.PublicKey, testPrivateKey); err == nil {
+               t.Error("specifying a MaxPathLen when IsCA is false should fail")
+       }
+
+       template.MaxPathLen = 0
+       template.MaxPathLenZero = true
+       if _, err := CreateCertificate(rand.Reader, template, template, &testPrivateKey.PublicKey, testPrivateKey); err == nil {
+               t.Error("setting MaxPathLenZero when IsCA is false should fail")
+       }
+
+       template.BasicConstraintsValid = false
+       cert2 := serialiseAndParse(t, template)
+       if m := cert2.MaxPathLen; m != 0 {
+               t.Errorf("Bad MaxPathLen should be ignored if BasicConstraintsValid is false, got %d", m)
+       }
+}
+
 func TestMaxPathLen(t *testing.T) {
        template := &Certificate{
                SerialNumber: big.NewInt(1),