{"action":"created","comment":{"url":"https://api.github.com/repos/openssl/openssl/pulls/comments/223033566","pull_request_review_id":162069697,"id":223033566,"node_id":"MDI0OlB1bGxSZXF1ZXN0UmV2aWV3Q29tbWVudDIyMzAzMzU2Ng==","diff_hunk":"@@ -524,8 +524,8 @@ static int check_chain_extensions(X509_STORE_CTX *ctx)\n             if (!verify_cb_cert(ctx, x, i, X509_V_ERR_PATH_LENGTH_EXCEEDED))\n                 return 0;\n         }\n-        /* Increment path length if not self issued */\n-        if (!(x->ex_flags & EXFLAG_SI))\n+        /* Increment path length if not a self issued intermediate CA */\n+        if (i == 0 || (x->ex_flags & EXFLAG_SI) == 0)","path":"crypto/x509/x509_vfy.c","position":7,"original_position":7,"commit_id":"fc0ac1341fbe808c4b8c14db629dca556dbd0aea","original_commit_id":"fc0ac1341fbe808c4b8c14db629dca556dbd0aea","user":{"login":"vdukhovni","id":1107986,"node_id":"MDQ6VXNlcjExMDc5ODY=","avatar_url":"https://avatars2.githubusercontent.com/u/1107986?v=4","gravatar_id":"","url":"https://api.github.com/users/vdukhovni","html_url":"https://github.com/vdukhovni","followers_url":"https://api.github.com/users/vdukhovni/followers","following_url":"https://api.github.com/users/vdukhovni/following{/other_user}","gists_url":"https://api.github.com/users/vdukhovni/gists{/gist_id}","starred_url":"https://api.github.com/users/vdukhovni/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vdukhovni/subscriptions","organizations_url":"https://api.github.com/users/vdukhovni/orgs","repos_url":"https://api.github.com/users/vdukhovni/repos","events_url":"https://api.github.com/users/vdukhovni/events{/privacy}","received_events_url":"https://api.github.com/users/vdukhovni/received_events","type":"User","site_admin":false},"body":"The code is not intended to fail to validate leaf-position CAs that have \"CA:true\" whose issuer has path length:0.  While the former cannot be used as intermediate CAs to issue  EE certs, they are valid leaf certificates, when used as such.  There is no \"off by one\", the patched code produces correct results with \"plen\" (at the time of the test) being the count of CAs in the path including the present CA, so a violation entails of `plen > ex_pathlen + 1` (ignoring the proxy stuff).","created_at":"2018-10-05T14:48:50Z","updated_at":"2018-10-05T14:48:50Z","html_url":"https://github.com/openssl/openssl/pull/7353#discussion_r223033566","pull_request_url":"https://api.github.com/repos/openssl/openssl/pulls/7353","author_association":"NONE","_links":{"self":{"href":"https://api.github.com/repos/openssl/openssl/pulls/comments/223033566"},"html":{"href":"https://github.com/openssl/openssl/pull/7353#discussion_r223033566"},"pull_request":{"href":"https://api.github.com/repos/openssl/openssl/pulls/7353"}},"in_reply_to_id":222911809},"pull_request":{"url":"https://api.github.com/repos/openssl/openssl/pulls/7353","id":220586959,"node_id":"MDExOlB1bGxSZXF1ZXN0MjIwNTg2OTU5","html_url":"https://github.com/openssl/openssl/pull/7353","diff_url":"https://github.com/openssl/openssl/pull/7353.diff","patch_url":"https://github.com/openssl/openssl/pull/7353.patch","issue_url":"https://api.github.com/repos/openssl/openssl/issues/7353","number":7353,"state":"open","locked":false,"title":"Only CA certificates can be self-issued (all branches, master first).","user":{"login":"vdukhovni","id":1107986,"node_id":"MDQ6VXNlcjExMDc5ODY=","avatar_url":"https://avatars2.githubusercontent.com/u/1107986?v=4","gravatar_id":"","url":"https://api.github.com/users/vdukhovni","html_url":"https://github.com/vdukhovni","followers_url":"https://api.github.com/users/vdukhovni/followers","following_url":"https://api.github.com/users/vdukhovni/following{/other_user}","gists_url":"https://api.github.com/users/vdukhovni/gists{/gist_id}","starred_url":"https://api.github.com/users/vdukhovni/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vdukhovni/subscriptions","organizations_url":"https://api.github.com/users/vdukhovni/orgs","repos_url":"https://api.github.com/users/vdukhovni/repos","events_url":"https://api.github.com/users/vdukhovni/events{/privacy}","received_events_url":"https://api.github.com/users/vdukhovni/received_events","type":"User","site_admin":false},"body":"At the bottom of https://tools.ietf.org/html/rfc5280#page-12 and\r\ntop of https://tools.ietf.org/html/rfc5280#page-13 (last paragraph\r\nof above https://tools.ietf.org/html/rfc5280#section-3.3), we see:\r\n\r\n   This specification covers two classes of certificates: CA\r\n   certificates and end entity certificates.  CA certificates may be\r\n   further divided into three classes: cross-certificates, self-issued\r\n   certificates, and self-signed certificates.  Cross-certificates are\r\n   CA certificates in which the issuer and subject are different\r\n   entities.  Cross-certificates describe a trust relationship between\r\n   the two CAs.  Self-issued certificates are CA certificates in which\r\n   the issuer and subject are the same entity.  Self-issued certificates\r\n   are generated to support changes in policy or operations.  Self-\r\n   signed certificates are self-issued certificates where the digital\r\n   signature may be verified by the public key bound into the\r\n   certificate.  Self-signed certificates are used to convey a public\r\n   key for use to begin certification paths.  End entity certificates\r\n   are issued to subjects that are not authorized to issue certificates.\r\n\r\nthat the term \"self-issued\" is only applicable to CAs, not end-entity\r\ncertificates.  In https://tools.ietf.org/html/rfc5280#section-4.2.1.9\r\nthe description of path length constraints says:\r\n\r\n   The pathLenConstraint field is meaningful only if the cA boolean is\r\n   asserted and the key usage extension, if present, asserts the\r\n   keyCertSign bit (Section 4.2.1.3).  In this case, it gives the\r\n   maximum number of non-self-issued intermediate certificates that may\r\n   follow this certificate in a valid certification path.  (Note: The\r\n   last certificate in the certification path is not an intermediate\r\n   certificate, and is not included in this limit.  Usually, the last\r\n   certificate is an end entity certificate, but it can be a CA\r\n   certificate.)\r\n\r\nThis makes it clear that exclusion of self-issued certificates from\r\nthe path length count applies only to some *intermediate* CA\r\ncertificates.  A leaf certificate whether it has identical issuer\r\nand subject or whether it is a CA or not is never part of the\r\nintermediate certificate count.  The handling of all leaf certificates\r\nmust be the same, in the case of our code to post-increment the\r\npath count by 1, so that we ultimately reach a non-self-issued\r\nintermediate it will be the first one (not zeroth) in the chain\r\nof intermediates.","created_at":"2018-10-05T05:07:42Z","updated_at":"2018-10-05T14:48:50Z","closed_at":null,"merged_at":null,"merge_commit_sha":"781509be7e5b71b7da86f8b1f3892c88fdccfcb6","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[],"milestone":null,"commits_url":"https://api.github.com/repos/openssl/openssl/pulls/7353/commits","review_comments_url":"https://api.github.com/repos/openssl/openssl/pulls/7353/comments","review_comment_url":"https://api.github.com/repos/openssl/openssl/pulls/comments{/number}","comments_url":"https://api.github.com/repos/openssl/openssl/issues/7353/comments","statuses_url":"https://api.github.com/repos/openssl/openssl/statuses/fc0ac1341fbe808c4b8c14db629dca556dbd0aea","head":{"label":"vdukhovni:fix-self-issued-ee-path-length-checks","ref":"fix-self-issued-ee-path-length-checks","sha":"fc0ac1341fbe808c4b8c14db629dca556dbd0aea","user":{"login":"vdukhovni","id":1107986,"node_id":"MDQ6VXNlcjExMDc5ODY=","avatar_url":"https://avatars2.githubusercontent.com/u/1107986?v=4","gravatar_id":"","url":"https://api.github.com/users/vdukhovni","html_url":"https://github.com/vdukhovni","followers_url":"https://api.github.com/users/vdukhovni/followers","following_url":"https://api.github.com/users/vdukhovni/following{/other_user}","gists_url":"https://api.github.com/users/vdukhovni/gists{/gist_id}","starred_url":"https://api.github.com/users/vdukhovni/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vdukhovni/subscriptions","organizations_url":"https://api.github.com/users/vdukhovni/orgs","repos_url":"https://api.github.com/users/vdukhovni/repos","events_url":"https://api.github.com/users/vdukhovni/events{/privacy}","received_events_url":"https://api.github.com/users/vdukhovni/received_events","type":"User","site_admin":false},"repo":{"id":55311918,"node_id":"MDEwOlJlcG9zaXRvcnk1NTMxMTkxOA==","name":"openssl","full_name":"vdukhovni/openssl","private":false,"owner":{"login":"vdukhovni","id":1107986,"node_id":"MDQ6VXNlcjExMDc5ODY=","avatar_url":"https://avatars2.githubusercontent.com/u/1107986?v=4","gravatar_id":"","url":"https://api.github.com/users/vdukhovni","html_url":"https://github.com/vdukhovni","followers_url":"https://api.github.com/users/vdukhovni/followers","following_url":"https://api.github.com/users/vdukhovni/following{/other_user}","gists_url":"https://api.github.com/users/vdukhovni/gists{/gist_id}","starred_url":"https://api.github.com/users/vdukhovni/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vdukhovni/subscriptions","organizations_url":"https://api.github.com/users/vdukhovni/orgs","repos_url":"https://api.github.com/users/vdukhovni/repos","events_url":"https://api.github.com/users/vdukhovni/events{/privacy}","received_events_url":"https://api.github.com/users/vdukhovni/received_events","type":"User","site_admin":false},"html_url":"https://github.com/vdukhovni/openssl","description":"TLS/SSL and crypto library","fork":true,"url":"https://api.github.com/repos/vdukhovni/openssl","forks_url":"https://api.github.com/repos/vdukhovni/openssl/forks","keys_url":"https://api.github.com/repos/vdukhovni/openssl/keys{/key_id}","collaborators_url":"https://api.github.com/repos/vdukhovni/openssl/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/vdukhovni/openssl/teams","hooks_url":"https://api.github.com/repos/vdukhovni/openssl/hooks","issue_events_url":"https://api.github.com/repos/vdukhovni/openssl/issues/events{/number}","events_url":"https://api.github.com/repos/vdukhovni/openssl/events","assignees_url":"https://api.github.com/repos/vdukhovni/openssl/assignees{/user}","branches_url":"https://api.github.com/repos/vdukhovni/openssl/branches{/branch}","tags_url":"https://api.github.com/repos/vdukhovni/openssl/tags","blobs_url":"https://api.github.com/repos/vdukhovni/openssl/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/vdukhovni/openssl/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/vdukhovni/openssl/git/refs{/sha}","trees_url":"https://api.github.com/repos/vdukhovni/openssl/git/trees{/sha}","statuses_url":"https://api.github.com/repos/vdukhovni/openssl/statuses/{sha}","languages_url":"https://api.github.com/repos/vdukhovni/openssl/languages","stargazers_url":"https://api.github.com/repos/vdukhovni/openssl/stargazers","contributors_url":"https://api.github.com/repos/vdukhovni/openssl/contributors","subscribers_url":"https://api.github.com/repos/vdukhovni/openssl/subscribers","subscription_url":"https://api.github.com/repos/vdukhovni/openssl/subscription","commits_url":"https://api.github.com/repos/vdukhovni/openssl/commits{/sha}","git_commits_url":"https://api.github.com/repos/vdukhovni/openssl/git/commits{/sha}","comments_url":"https://api.github.com/repos/vdukhovni/openssl/comments{/number}","issue_comment_url":"https://api.github.com/repos/vdukhovni/openssl/issues/comments{/number}","contents_url":"https://api.github.com/repos/vdukhovni/openssl/contents/{+path}","compare_url":"https://api.github.com/repos/vdukhovni/openssl/compare/{base}...{head}","merges_url":"https://api.github.com/repos/vdukhovni/openssl/merges","archive_url":"https://api.github.com/repos/vdukhovni/openssl/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/vdukhovni/openssl/downloads","issues_url":"https://api.github.com/repos/vdukhovni/openssl/issues{/number}","pulls_url":"https://api.github.com/repos/vdukhovni/openssl/pulls{/number}","milestones_url":"https://api.github.com/repos/vdukhovni/openssl/milestones{/number}","notifications_url":"https://api.github.com/repos/vdukhovni/openssl/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/vdukhovni/openssl/labels{/name}","releases_url":"https://api.github.com/repos/vdukhovni/openssl/releases{/id}","deployments_url":"https://api.github.com/repos/vdukhovni/openssl/deployments","created_at":"2016-04-02T19:15:53Z","updated_at":"2016-04-02T19:16:04Z","pushed_at":"2018-10-05T05:05:58Z","git_url":"git://github.com/vdukhovni/openssl.git","ssh_url":"git@github.com:vdukhovni/openssl.git","clone_url":"https://github.com/vdukhovni/openssl.git","svn_url":"https://github.com/vdukhovni/openssl","homepage":"https://www.openssl.org","size":155311,"stargazers_count":0,"watchers_count":0,"language":"C","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"license":{"key":"other","name":"NOASSERTION","spdx_id":"NOASSERTION","url":null,"node_id":"MDc6TGljZW5zZTA="},"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"openssl:master","ref":"master","sha":"52d78cc5ebc1d4fc021cabbcb09f4efb4c6ae82d","user":{"login":"openssl","id":3279138,"node_id":"MDEyOk9yZ2FuaXphdGlvbjMyNzkxMzg=","avatar_url":"https://avatars2.githubusercontent.com/u/3279138?v=4","gravatar_id":"","url":"https://api.github.com/users/openssl","html_url":"https://github.com/openssl","followers_url":"https://api.github.com/users/openssl/followers","following_url":"https://api.github.com/users/openssl/following{/other_user}","gists_url":"https://api.github.com/users/openssl/gists{/gist_id}","starred_url":"https://api.github.com/users/openssl/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openssl/subscriptions","organizations_url":"https://api.github.com/users/openssl/orgs","repos_url":"https://api.github.com/users/openssl/repos","events_url":"https://api.github.com/users/openssl/events{/privacy}","received_events_url":"https://api.github.com/users/openssl/received_events","type":"Organization","site_admin":false},"repo":{"id":7634677,"node_id":"MDEwOlJlcG9zaXRvcnk3NjM0Njc3","name":"openssl","full_name":"openssl/openssl","private":false,"owner":{"login":"openssl","id":3279138,"node_id":"MDEyOk9yZ2FuaXphdGlvbjMyNzkxMzg=","avatar_url":"https://avatars2.githubusercontent.com/u/3279138?v=4","gravatar_id":"","url":"https://api.github.com/users/openssl","html_url":"https://github.com/openssl","followers_url":"https://api.github.com/users/openssl/followers","following_url":"https://api.github.com/users/openssl/following{/other_user}","gists_url":"https://api.github.com/users/openssl/gists{/gist_id}","starred_url":"https://api.github.com/users/openssl/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openssl/subscriptions","organizations_url":"https://api.github.com/users/openssl/orgs","repos_url":"https://api.github.com/users/openssl/repos","events_url":"https://api.github.com/users/openssl/events{/privacy}","received_events_url":"https://api.github.com/users/openssl/received_events","type":"Organization","site_admin":false},"html_url":"https://github.com/openssl/openssl","description":"TLS/SSL and crypto library","fork":false,"url":"https://api.github.com/repos/openssl/openssl","forks_url":"https://api.github.com/repos/openssl/openssl/forks","keys_url":"https://api.github.com/repos/openssl/openssl/keys{/key_id}","collaborators_url":"https://api.github.com/repos/openssl/openssl/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/openssl/openssl/teams","hooks_url":"https://api.github.com/repos/openssl/openssl/hooks","issue_events_url":"https://api.github.com/repos/openssl/openssl/issues/events{/number}","events_url":"https://api.github.com/repos/openssl/openssl/events","assignees_url":"https://api.github.com/repos/openssl/openssl/assignees{/user}","branches_url":"https://api.github.com/repos/openssl/openssl/branches{/branch}","tags_url":"https://api.github.com/repos/openssl/openssl/tags","blobs_url":"https://api.github.com/repos/openssl/openssl/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/openssl/openssl/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/openssl/openssl/git/refs{/sha}","trees_url":"https://api.github.com/repos/openssl/openssl/git/trees{/sha}","statuses_url":"https://api.github.com/repos/openssl/openssl/statuses/{sha}","languages_url":"https://api.github.com/repos/openssl/openssl/languages","stargazers_url":"https://api.github.com/repos/openssl/openssl/stargazers","contributors_url":"https://api.github.com/repos/openssl/openssl/contributors","subscribers_url":"https://api.github.com/repos/openssl/openssl/subscribers","subscription_url":"https://api.github.com/repos/openssl/openssl/subscription","commits_url":"https://api.github.com/repos/openssl/openssl/commits{/sha}","git_commits_url":"https://api.github.com/repos/openssl/openssl/git/commits{/sha}","comments_url":"https://api.github.com/repos/openssl/openssl/comments{/number}","issue_comment_url":"https://api.github.com/repos/openssl/openssl/issues/comments{/number}","contents_url":"https://api.github.com/repos/openssl/openssl/contents/{+path}","compare_url":"https://api.github.com/repos/openssl/openssl/compare/{base}...{head}","merges_url":"https://api.github.com/repos/openssl/openssl/merges","archive_url":"https://api.github.com/repos/openssl/openssl/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/openssl/openssl/downloads","issues_url":"https://api.github.com/repos/openssl/openssl/issues{/number}","pulls_url":"https://api.github.com/repos/openssl/openssl/pulls{/number}","milestones_url":"https://api.github.com/repos/openssl/openssl/milestones{/number}","notifications_url":"https://api.github.com/repos/openssl/openssl/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/openssl/openssl/labels{/name}","releases_url":"https://api.github.com/repos/openssl/openssl/releases{/id}","deployments_url":"https://api.github.com/repos/openssl/openssl/deployments","created_at":"2013-01-15T22:34:48Z","updated_at":"2018-10-05T14:06:54Z","pushed_at":"2018-10-05T10:24:00Z","git_url":"git://github.com/openssl/openssl.git","ssh_url":"git@github.com:openssl/openssl.git","clone_url":"https://github.com/openssl/openssl.git","svn_url":"https://github.com/openssl/openssl","homepage":"https://www.openssl.org","size":157819,"stargazers_count":8400,"watchers_count":8400,"language":"C","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":3832,"mirror_url":null,"archived":false,"open_issues_count":517,"license":{"key":"other","name":"NOASSERTION","spdx_id":"NOASSERTION","url":null,"node_id":"MDc6TGljZW5zZTA="},"forks":3832,"open_issues":517,"watchers":8400,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/openssl/openssl/pulls/7353"},"html":{"href":"https://github.com/openssl/openssl/pull/7353"},"issue":{"href":"https://api.github.com/repos/openssl/openssl/issues/7353"},"comments":{"href":"https://api.github.com/repos/openssl/openssl/issues/7353/comments"},"review_comments":{"href":"https://api.github.com/repos/openssl/openssl/pulls/7353/comments"},"review_comment":{"href":"https://api.github.com/repos/openssl/openssl/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/openssl/openssl/pulls/7353/commits"},"statuses":{"href":"https://api.github.com/repos/openssl/openssl/statuses/fc0ac1341fbe808c4b8c14db629dca556dbd0aea"}},"author_association":"NONE"}}
{"actor":{"display_login":"vdukhovni"}}