🔴 Live TV: CSP/x limbo/pull/

woodruffw · 2026-06-06T20:56:03Z

This mirrors some of Go's pathological chain testcases.

See: https://cs.opensource.google/go/go/+/master:src/crypto/x509/verify_test.go;l=1573?q=TestPathologi&sq=&ss=go%2Fgo

github-actions · 2026-06-06T23:20:47Z

No regressions found.

github-actions · 2026-06-06T23:20:48Z

New testcases

There are new testcases in this change.

rustls-webpki

Testcase	Expected Result	Actual Result	Context
`pathological::pathological-chain-same-subject-same-key`	FAILURE	FAILURE	UnknownIssuer
`pathological::pathological-chain-distinct-subject-distinct-key`	FAILURE	FAILURE	MaximumPathDepthExceeded
`pathological::pathological-chain-same-subject-distinct-key`	FAILURE	FAILURE	MaximumPathBuildCallsExceeded
`pathological::pathological-chain-distinct-subject-same-key`	FAILURE	FAILURE	MaximumPathDepthExceeded

libressl-4.1.2

Testcase	Expected Result	Actual Result	Context
`pathological::pathological-chain-same-subject-same-key`	FAILURE	FAILURE	certificate chain too long
`pathological::pathological-chain-distinct-subject-distinct-key`	FAILURE	FAILURE	certificate chain too long
`pathological::pathological-chain-same-subject-distinct-key`	FAILURE	FAILURE	subject issuer mismatch
`pathological::pathological-chain-distinct-subject-same-key`	FAILURE	FAILURE	certificate chain too long

boringssl-legacy-40

Testcase	Expected Result	Actual Result	Context
`pathological::pathological-chain-same-subject-same-key`	FAILURE	FAILURE	self signed certificate in certificate chain
`pathological::pathological-chain-distinct-subject-distinct-key`	FAILURE	FAILURE	self signed certificate in certificate chain
`pathological::pathological-chain-same-subject-distinct-key`	FAILURE	FAILURE	self signed certificate in certificate chain
`pathological::pathological-chain-distinct-subject-same-key`	FAILURE	FAILURE	self signed certificate in certificate chain

gocryptox509-go1.26.3

Testcase	Expected Result	Actual Result
`pathological::pathological-chain-same-subject-same-key`	FAILURE	FAILURE
`pathological::pathological-chain-distinct-subject-distinct-key`	FAILURE	FAILURE
`pathological::pathological-chain-same-subject-distinct-key`	FAILURE	FAILURE
`pathological::pathological-chain-distinct-subject-same-key`	FAILURE	FAILURE

libressl-4.2.1

Testcase	Expected Result	Actual Result	Context
`pathological::pathological-chain-same-subject-same-key`	FAILURE	FAILURE	certificate chain too long
`pathological::pathological-chain-distinct-subject-distinct-key`	FAILURE	FAILURE	certificate chain too long
`pathological::pathological-chain-same-subject-distinct-key`	FAILURE	FAILURE	subject issuer mismatch
`pathological::pathological-chain-distinct-subject-same-key`	FAILURE	FAILURE	certificate chain too long

pyca-cryptography-46.0.7

Testcase	Expected Result	Actual Result	Context
`pathological::pathological-chain-same-subject-same-key`	FAILURE	SKIPPED	testcase skipped (explicitly unsupported case)
`pathological::pathological-chain-distinct-subject-distinct-key`	FAILURE	FAILURE	validation failed: candidates exhausted: chain construction exceeds max depth
`pathological::pathological-chain-same-subject-distinct-key`	FAILURE	FAILURE	validation failed: candidates exhausted: signature does not match
`pathological::pathological-chain-distinct-subject-same-key`	FAILURE	FAILURE	validation failed: candidates exhausted: chain construction exceeds max depth

openssl-3.4.5

Testcase	Expected Result	Actual Result	Context
`pathological::pathological-chain-same-subject-same-key`	FAILURE	FAILURE	self-signed certificate in certificate chain
`pathological::pathological-chain-distinct-subject-distinct-key`	FAILURE	FAILURE	self-signed certificate in certificate chain
`pathological::pathological-chain-same-subject-distinct-key`	FAILURE	FAILURE	self-signed certificate in certificate chain
`pathological::pathological-chain-distinct-subject-same-key`	FAILURE	FAILURE	self-signed certificate in certificate chain

libressl-4.3.1

Testcase	Expected Result	Actual Result	Context
`pathological::pathological-chain-same-subject-same-key`	FAILURE	FAILURE	certificate chain too long
`pathological::pathological-chain-distinct-subject-distinct-key`	FAILURE	FAILURE	certificate chain too long
`pathological::pathological-chain-same-subject-distinct-key`	FAILURE	FAILURE	subject issuer mismatch
`pathological::pathological-chain-distinct-subject-same-key`	FAILURE	FAILURE	certificate chain too long

openssl-3.2.6

Testcase	Expected Result	Actual Result	Context
`pathological::pathological-chain-same-subject-same-key`	FAILURE	FAILURE	self-signed certificate in certificate chain
`pathological::pathological-chain-distinct-subject-distinct-key`	FAILURE	FAILURE	self-signed certificate in certificate chain
`pathological::pathological-chain-same-subject-distinct-key`	FAILURE	FAILURE	self-signed certificate in certificate chain
`pathological::pathological-chain-distinct-subject-same-key`	FAILURE	FAILURE	self-signed certificate in certificate chain

libressl-4.0.1

Testcase	Expected Result	Actual Result	Context
`pathological::pathological-chain-same-subject-same-key`	FAILURE	FAILURE	certificate chain too long
`pathological::pathological-chain-distinct-subject-distinct-key`	FAILURE	FAILURE	certificate chain too long
`pathological::pathological-chain-same-subject-distinct-key`	FAILURE	FAILURE	subject issuer mismatch
`pathological::pathological-chain-distinct-subject-same-key`	FAILURE	FAILURE	certificate chain too long

libressl-3.9.2

Testcase	Expected Result	Actual Result	Context
`pathological::pathological-chain-same-subject-same-key`	FAILURE	FAILURE	certificate chain too long
`pathological::pathological-chain-distinct-subject-distinct-key`	FAILURE	FAILURE	certificate chain too long
`pathological::pathological-chain-same-subject-distinct-key`	FAILURE	FAILURE	subject issuer mismatch
`pathological::pathological-chain-distinct-subject-same-key`	FAILURE	FAILURE	certificate chain too long

openssl-4.0.0

Testcase	Expected Result	Actual Result	Context
`pathological::pathological-chain-same-subject-same-key`	FAILURE	FAILURE	self-signed certificate in certificate chain
`pathological::pathological-chain-distinct-subject-distinct-key`	FAILURE	FAILURE	self-signed certificate in certificate chain
`pathological::pathological-chain-same-subject-distinct-key`	FAILURE	FAILURE	self-signed certificate in certificate chain
`pathological::pathological-chain-distinct-subject-same-key`	FAILURE	FAILURE	self-signed certificate in certificate chain

openssl-3.5.6

Testcase	Expected Result	Actual Result	Context
`pathological::pathological-chain-same-subject-same-key`	FAILURE	FAILURE	self-signed certificate in certificate chain
`pathological::pathological-chain-distinct-subject-distinct-key`	FAILURE	FAILURE	self-signed certificate in certificate chain
`pathological::pathological-chain-same-subject-distinct-key`	FAILURE	FAILURE	self-signed certificate in certificate chain
`pathological::pathological-chain-distinct-subject-same-key`	FAILURE	FAILURE	self-signed certificate in certificate chain

certvalidator-0.11.1

Testcase	Expected Result	Actual Result	Context
`pathological::pathological-chain-same-subject-same-key`	FAILURE	HANG	testcase timed out
`pathological::pathological-chain-distinct-subject-distinct-key`	FAILURE	FAILURE	Unable to build a validation path for the certificate "Common Name: example.com" - no issuer matching "Common Name: Pathological CA #0" was found
`pathological::pathological-chain-same-subject-distinct-key`	FAILURE	HANG	testcase timed out
`pathological::pathological-chain-distinct-subject-same-key`	FAILURE	FAILURE	Unable to build a validation path for the certificate "Common Name: example.com" - no issuer matching "Common Name: Pathological CA #0" was found

openssl-3.6.2

Testcase	Expected Result	Actual Result	Context
`pathological::pathological-chain-same-subject-same-key`	FAILURE	FAILURE	self-signed certificate in certificate chain
`pathological::pathological-chain-distinct-subject-distinct-key`	FAILURE	FAILURE	self-signed certificate in certificate chain
`pathological::pathological-chain-same-subject-distinct-key`	FAILURE	FAILURE	self-signed certificate in certificate chain
`pathological::pathological-chain-distinct-subject-same-key`	FAILURE	FAILURE	self-signed certificate in certificate chain

openssl-3.0.20

Testcase	Expected Result	Actual Result	Context
`pathological::pathological-chain-same-subject-same-key`	FAILURE	FAILURE	self-signed certificate in certificate chain
`pathological::pathological-chain-distinct-subject-distinct-key`	FAILURE	FAILURE	self-signed certificate in certificate chain
`pathological::pathological-chain-same-subject-distinct-key`	FAILURE	FAILURE	self-signed certificate in certificate chain
`pathological::pathological-chain-distinct-subject-same-key`	FAILURE	FAILURE	self-signed certificate in certificate chain

aws-lc-1.72.0

Testcase	Expected Result	Actual Result	Context
`pathological::pathological-chain-same-subject-same-key`	FAILURE	FAILURE	self signed certificate in certificate chain
`pathological::pathological-chain-distinct-subject-distinct-key`	FAILURE	FAILURE	self signed certificate in certificate chain
`pathological::pathological-chain-same-subject-distinct-key`	FAILURE	FAILURE	self signed certificate in certificate chain
`pathological::pathological-chain-distinct-subject-same-key`	FAILURE	FAILURE	self signed certificate in certificate chain

openssl-3.3.7

Testcase	Expected Result	Actual Result	Context
`pathological::pathological-chain-same-subject-same-key`	FAILURE	FAILURE	self-signed certificate in certificate chain
`pathological::pathological-chain-distinct-subject-distinct-key`	FAILURE	FAILURE	self-signed certificate in certificate chain
`pathological::pathological-chain-same-subject-distinct-key`	FAILURE	FAILURE	self-signed certificate in certificate chain
`pathological::pathological-chain-distinct-subject-same-key`	FAILURE	FAILURE	self-signed certificate in certificate chain

gnutls-certtool-3.8.3

Testcase	Expected Result	Actual Result	Context
`pathological::pathological-chain-same-subject-same-key`	FAILURE	FAILURE	Chain verification output: Not verified. The certificate is NOT trusted. The certificate issuer is unknown.
`pathological::pathological-chain-distinct-subject-distinct-key`	FAILURE	FAILURE	Chain verification output: Not verified. The certificate is NOT trusted. The certificate issuer is unknown.
`pathological::pathological-chain-same-subject-distinct-key`	FAILURE	FAILURE	Chain verification output: Not verified. The certificate is NOT trusted. The certificate issuer is unknown.
`pathological::pathological-chain-distinct-subject-same-key`	FAILURE	FAILURE	Chain verification output: Not verified. The certificate is NOT trusted. The certificate issuer is unknown.

rust-webpki

Testcase	Expected Result	Actual Result	Context
`pathological::pathological-chain-same-subject-same-key`	FAILURE	FAILURE	UnknownIssuer
`pathological::pathological-chain-distinct-subject-distinct-key`	FAILURE	FAILURE	UnknownIssuer
`pathological::pathological-chain-same-subject-distinct-key`	FAILURE	FAILURE	maximum path build calls exceeded
`pathological::pathological-chain-distinct-subject-same-key`	FAILURE	FAILURE	UnknownIssuer

openssl-1.1

Testcase	Expected Result	Actual Result	Context
`pathological::pathological-chain-same-subject-same-key`	FAILURE	FAILURE	self signed certificate in certificate chain
`pathological::pathological-chain-distinct-subject-distinct-key`	FAILURE	FAILURE	self signed certificate in certificate chain
`pathological::pathological-chain-same-subject-distinct-key`	FAILURE	FAILURE	self signed certificate in certificate chain
`pathological::pathological-chain-distinct-subject-same-key`	FAILURE	FAILURE	self signed certificate in certificate chain

woodruffw self-assigned this Jun 6, 2026

woodruffw added 4 commits June 6, 2026 18:11

Add four more pathological chain tests

a48eb55

Fixups

27db218

Add some regression test limits

bba3b9c

Add NOTE

108ef74

woodruffw force-pushed the ww/more-pathological branch from 23d224d to 108ef74 Compare June 6, 2026 22:11

woodruffw added 2 commits June 6, 2026 18:13

Add another timeout

c5a8948

Proper cancellation

0399452

github-actions Bot added the 🙈 no-regressions label Jun 6, 2026

woodruffw merged commit 8e1700f into main Jun 6, 2026
9 checks passed

woodruffw deleted the ww/more-pathological branch June 6, 2026 23:38

cpu mentioned this pull request Jun 9, 2026

update x509-limbo to latest rustls/webpki#508

Merged

Navigation Menu

Repository navigation

Add four more pathological chain tests - #623

Add four more pathological chain tests#623
woodruffw merged 6 commits into
mainfrom
ww/more-pathological

woodruffw commented Jun 6, 2026

Uh oh!

github-actions Bot commented Jun 6, 2026

Uh oh!

github-actions Bot commented Jun 6, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

woodruffw commented Jun 6, 2026

Uh oh!

github-actions Bot commented Jun 6, 2026

Uh oh!

github-actions Bot commented Jun 6, 2026

New testcases

rustls-webpki

libressl-4.1.2

boringssl-legacy-40

gocryptox509-go1.26.3

libressl-4.2.1

pyca-cryptography-46.0.7

openssl-3.4.5

libressl-4.3.1

openssl-3.2.6

libressl-4.0.1

libressl-3.9.2

openssl-4.0.0

openssl-3.5.6

certvalidator-0.11.1

openssl-3.6.2

openssl-3.0.20

aws-lc-1.72.0

openssl-3.3.7

gnutls-certtool-3.8.3

rust-webpki

openssl-1.1

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant