[Bug]: `x509_v2` `basicConstraints` does not validate `pathlen` against issuer cert
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 15.7k
- Forks
- 5.6k
- Avg merge
- 2d 44m
- Merged PRs (30d)
- 80
Description
What happened?
When creating a CA certificate with a basicConstraints extension, salt.utils.x509._create_basic_constraints does not validate that an explicit pathlen is at most one lower than the one specified in the issuer certificate.
Also, if pathlen is not specified, it should default to pathlen_of_issuer - 1, while it currently issues a cert without one.
Type of salt install
Official deb
Major version
3006.x, 3007.x, 3008.x
What supported OS are you seeing the problem on? Can select multiple. (If bug appears on an unsupported OS, please open a GitHub Discussion instead)
ubuntu-24.04
salt --versions-report output
Latest HEAD of 3006.x
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at salt.utils.x509._create_basic_constraints and trace how the issuer certificate’s basicConstraints pathlen is read. Verify the behavior for an explicit pathlen and for an omitted pathlen, then add or update the relevant x509 tests so invalid limits are rejected and the derived limit is covered.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- cryptography, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 68/100