crypto/x509: MaxConstraintComparisions is documented but not enforced

[jvdprng]

Description

VerifyOptions.MaxConstraintComparisions is documented as a limit on name-constraint comparison work in the pure-Go verifier, with TooManyConstraints as the corresponding failure reason. The finding indicates that the documented limit is not enforced in the relevant pure-Go verification path.

This is a documented-option bug rather than a demonstrated vulnerability.

Specification or documentation

This is primarily a Go API documentation/behavior mismatch. The relevant public documentation says the limit prevents pathological certificates from consuming excessive CPU while validating.

Code references

• go/src/crypto/x509/verify.go:51 through go/src/crypto/x509/verify.go:56 documents the TooManyConstraints invalid reason.
• go/src/crypto/x509/verify.go:214 through go/src/crypto/x509/verify.go:219 documents VerifyOptions.MaxConstraintComparisions.
• go/src/crypto/x509/constraints.go:416 is in the name-constraint checking code path.

Test case

This should be an X.509 verification unit test: construct a chain with enough permitted/excluded names to exceed a very small MaxConstraintComparisions value and assert that Verify returns TooManyConstraints.

It could be added as an X.509 verification regression test.

[gabyhelp]

Related Issues

• crypto/x509: reject non-profile minimum/maximum in GeneralSubtree name constraints #77826
• crypto/x509: Certificate.Verify does not enforce name constraints correctly #59171 (closed)
• crypto/x509: Certificate parsing/verification supports non-compliant dNSName constraints #37535 (closed)
• crypto/x509: reject end-entity certs w/ name constraint ext. #79742
• crypto/x509: Verify should error if non-CA certificate contains name constraints #71795
• crypto/x509: don't apply name constraints to non-terminal self-issued certs #79746

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[jvdprng]

Playground reproducer: https://go.dev/play/p/R_c4-egO_ib

[cherrymui]

cc @golang/security

[rolandshoemaker]

When we replaced the constraint checking algorithm with the logarithmic one the need for this config knob became a bit redundant. We should probably just deprecate it and document that it doesn't do anything anymore.