From 278ba6b3d2099e38f40df9ffac2e09e3407502fc Mon Sep 17 00:00:00 2001 From: tb <> Date: Mon, 4 May 2026 13:55:20 +0000 Subject: verifier: re-enable the callback override for depth kirill reported that his nginx reverse proxy setup stopped working with x509_verify.c r1.74 and r1.75. It turns out that nginx relies on a verify callback that always returns 1. In revision 1.74 we removed the possibility of the verify_cb() to override X509_V_ERR_CERT_CHAIN_TOO_LONG, which is what breaks the config in kirill's setup since it used to use the nginx default of setting the depth to 1. Re-enable this to make the new scenario "2a with depth 1 and depth callback" pass. As shown by the other new test scenario "14b with yolo calback" with a "just say yes" cb, the guard added in r1.74 still prevents the overwrite. This makes kirill's reproducer work as verified by kirill and myself. It was also tested by kirill in the real life setup. discussed with beck ok jsing kenjiro --- src/lib/libcrypto/x509/x509_verify.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/src/lib/libcrypto/x509/x509_verify.c b/src/lib/libcrypto/x509/x509_verify.c index fc3fbc14da..640558b685 100644 --- a/src/lib/libcrypto/x509/x509_verify.c +++ b/src/lib/libcrypto/x509/x509_verify.c @@ -1,4 +1,4 @@ -/* $OpenBSD: x509_verify.c,v 1.75 2026/04/01 14:38:26 jsing Exp $ */ +/* $OpenBSD: x509_verify.c,v 1.76 2026/05/04 13:55:20 tb Exp $ */ /* * Copyright (c) 2020-2021 Bob Beck * @@ -668,11 +668,9 @@ x509_verify_build_chains(struct x509_verify_ctx *ctx, X509 *cert, depth = sk_X509_num(current_chain->certs); if (depth > 0) depth--; - if (depth >= ctx->max_depth) { - (void)x509_verify_cert_error(ctx, cert, depth, - X509_V_ERR_CERT_CHAIN_TOO_LONG, 0); + if (depth >= ctx->max_depth && !x509_verify_cert_error(ctx, cert, depth, + X509_V_ERR_CERT_CHAIN_TOO_LONG, 0)) return; - } count = ctx->chains_count; -- cgit v1.2.3-55-g6feb