Address Chris' feedback and add cross-signed chain to tests

Author: lukevalenta

crates/static_ct_api/tests/cloudflare.pem

@@ -0,0 +1,74 @@
+Certificate chain
+ 0 s:CN=26d54cff.sni.cloudflaressl.com
+   i:C=US, O=Google Trust Services, CN=WE1
+   a:PKEY: EC, (prime256v1); sigalg: ecdsa-with-SHA256
+   v:NotBefore: Sep 10 18:11:56 2025 GMT; NotAfter: Dec  9 19:11:41 2025 GMT
+-----BEGIN CERTIFICATE-----
+MIIDyTCCA3CgAwIBAgIQQOWg2Nc9XhAT1toRzArhVzAKBggqhkjOPQQDAjA7MQsw
+CQYDVQQGEwJVUzEeMBwGA1UEChMVR29vZ2xlIFRydXN0IFNlcnZpY2VzMQwwCgYD
+VQQDEwNXRTEwHhcNMjUwOTEwMTgxMTU2WhcNMjUxMjA5MTkxMTQxWjApMScwJQYD
+VQQDEx4yNmQ1NGNmZi5zbmkuY2xvdWRmbGFyZXNzbC5jb20wWTATBgcqhkjOPQIB
+BggqhkjOPQMBBwNCAATucLtnF8oOVucAgsWa82hdrSAkYJwy19iZTdlBeqTZQUvE
+3VabmY4/xxWQ3womrnpQE6F2dul51ilAalRqTLGOo4ICZjCCAmIwDgYDVR0PAQH/
+BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwHQYDVR0O
+BBYEFPgeK75wrmRIIvqJyzwf/y2QzmHdMB8GA1UdIwQYMBaAFJB3kjVnxP+ozKnm
+e9mAeXvMk/k4MF4GCCsGAQUFBwEBBFIwUDAnBggrBgEFBQcwAYYbaHR0cDovL28u
+cGtpLmdvb2cvcy93ZTEvUU9VMCUGCCsGAQUFBzAChhlodHRwOi8vaS5wa2kuZ29v
+Zy93ZTEuY3J0MDkGA1UdEQQyMDCCHjI2ZDU0Y2ZmLnNuaS5jbG91ZGZsYXJlc3Ns
+LmNvbYIOY2xvdWRmbGFyZS5jb20wEwYDVR0gBAwwCjAIBgZngQwBAgEwNgYDVR0f
+BC8wLTAroCmgJ4YlaHR0cDovL2MucGtpLmdvb2cvd2UxL1h3N2s5OTVCdlZnLmNy
+bDCCAQMGCisGAQQB1nkCBAIEgfQEgfEA7wB1AN3cyjSV1+EWBeeVMvrHn/g9HFDf
+2wA6FBJ2Ciysu8gqAAABmTUKsOAAAAQDAEYwRAIgSbCq102Ac0iSU6uTmAw1JcUj
+uLjCUKbHfX1jUi+4E0gCIDc2CklQ/04aH+En9ItnhzQ/zbKLEMkkkPshMYyQsLPx
+AHYAzPsPaoVxCWX+lZtTzumyfCLphVwNl422qX5UwP5MDbAAAAGZNQqw9AAABAMA
+RzBFAiBHdDICfuFVofCodDiC+VQ39Nw+EQVrohHSg7o8qyTPugIhAKh0/D8fcasn
+8KaxEDLhxlQilBzQW9gP/iOlL4LasCAKMAoGCCqGSM49BAMCA0cAMEQCIFCuCbXl
+cBlfWavWj7O0lN4aoxYVIsbbtF5VJqCEJfv5AiBLkdTa3bls3f8PbF0PZiec3QnQ
+51nWenFitQt3t0xyUA==
+-----END CERTIFICATE-----
+ 1 s:C=US, O=Google Trust Services, CN=WE1
+   i:C=US, O=Google Trust Services LLC, CN=GTS Root R4
+   a:PKEY: EC, (prime256v1); sigalg: ecdsa-with-SHA384
+   v:NotBefore: Dec 13 09:00:00 2023 GMT; NotAfter: Feb 20 14:00:00 2029 GMT
+-----BEGIN CERTIFICATE-----
+MIICnzCCAiWgAwIBAgIQf/MZd5csIkp2FV0TttaF4zAKBggqhkjOPQQDAzBHMQsw
+CQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzEU
+MBIGA1UEAxMLR1RTIFJvb3QgUjQwHhcNMjMxMjEzMDkwMDAwWhcNMjkwMjIwMTQw
+MDAwWjA7MQswCQYDVQQGEwJVUzEeMBwGA1UEChMVR29vZ2xlIFRydXN0IFNlcnZp
+Y2VzMQwwCgYDVQQDEwNXRTEwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARvzTr+
+Z1dHTCEDhUDCR127WEcPQMFcF4XGGTfn1XzthkubgdnXGhOlCgP4mMTG6J7/EFmP
+LCaY9eYmJbsPAvpWo4H+MIH7MA4GA1UdDwEB/wQEAwIBhjAdBgNVHSUEFjAUBggr
+BgEFBQcDAQYIKwYBBQUHAwIwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHQ4EFgQU
+kHeSNWfE/6jMqeZ72YB5e8yT+TgwHwYDVR0jBBgwFoAUgEzW63T/STaj1dj8tT7F
+avCUHYwwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzAChhhodHRwOi8vaS5wa2ku
+Z29vZy9yNC5jcnQwKwYDVR0fBCQwIjAgoB6gHIYaaHR0cDovL2MucGtpLmdvb2cv
+ci9yNC5jcmwwEwYDVR0gBAwwCjAIBgZngQwBAgEwCgYIKoZIzj0EAwMDaAAwZQIx
+AOcCq1HW90OVznX+0RGU1cxAQXomvtgM8zItPZCuFQ8jSBJSjz5keROv9aYsAm5V
+sQIwJonMaAFi54mrfhfoFNZEfuNMSQ6/bIBiNLiyoX46FohQvKeIoJ99cx7sUkFN
+7uJW
+-----END CERTIFICATE-----
+ 2 s:C=US, O=Google Trust Services LLC, CN=GTS Root R4
+   i:C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA
+   a:PKEY: EC, (secp384r1); sigalg: sha256WithRSAEncryption
+   v:NotBefore: Nov 15 03:43:21 2023 GMT; NotAfter: Jan 28 00:00:42 2028 GMT
+-----BEGIN CERTIFICATE-----
+MIIDejCCAmKgAwIBAgIQf+UwvzMTQ77dghYQST2KGzANBgkqhkiG9w0BAQsFADBX
+MQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEQMA4GA1UE
+CxMHUm9vdCBDQTEbMBkGA1UEAxMSR2xvYmFsU2lnbiBSb290IENBMB4XDTIzMTEx
+NTAzNDMyMVoXDTI4MDEyODAwMDA0MlowRzELMAkGA1UEBhMCVVMxIjAgBgNVBAoT
+GUdvb2dsZSBUcnVzdCBTZXJ2aWNlcyBMTEMxFDASBgNVBAMTC0dUUyBSb290IFI0
+MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE83Rzp2iLYK5DuDXFgTB7S0md+8Fhzube
+Rr1r1WEYNa5A3XP3iZEwWus87oV8okB2O6nGuEfYKueSkWpz6bFyOZ8pn6KY019e
+WIZlD6GEZQbR3IvJx3PIjGov5cSr0R2Ko4H/MIH8MA4GA1UdDwEB/wQEAwIBhjAd
+BgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDwYDVR0TAQH/BAUwAwEB/zAd
+BgNVHQ4EFgQUgEzW63T/STaj1dj8tT7FavCUHYwwHwYDVR0jBBgwFoAUYHtmGkUN
+l8qJUC99BM00qP/8/UswNgYIKwYBBQUHAQEEKjAoMCYGCCsGAQUFBzAChhpodHRw
+Oi8vaS5wa2kuZ29vZy9nc3IxLmNydDAtBgNVHR8EJjAkMCKgIKAehhxodHRwOi8v
+Yy5wa2kuZ29vZy9yL2dzcjEuY3JsMBMGA1UdIAQMMAowCAYGZ4EMAQIBMA0GCSqG
+SIb3DQEBCwUAA4IBAQAYQrsPBtYDh5bjP2OBDwmkoWhIDDkic574y04tfzHpn+cJ
+odI2D4SseesQ6bDrarZ7C30ddLibZatoKiws3UL9xnELz4ct92vID24FfVbiI1hY
++SW6FoVHkNeWIP0GCbaM4C6uVdF5dTUsMVs/ZbzNnIdCp5Gxmx5ejvEau8otR/Cs
+kGN+hr/W5GvT1tMBjgWKZ1i4//emhA1JG1BbPzoLJQvyEotc03lXjTaCzv8mEbep
+8RqZ7a2CPsgRbuvTPBwcOMBBmuFeU88+FSBX6+7iP0il8b4Z0QFqIwwMHfs/L6K1
+vepuoxtGzi4CZ68zJpiq1UvSqTbFJjtbD4seiMHl
+-----END CERTIFICATE-----

crates/static_ct_api/tests/google-gts-root-r4.pem

@@ -0,0 +1,13 @@
+-----BEGIN CERTIFICATE-----
+MIICCjCCAZGgAwIBAgIQbkepyIuUtui7OyrYorLBmTAKBggqhkjOPQQDAzBHMQsw
+CQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzEU
+MBIGA1UEAxMLR1RTIFJvb3QgUjQwHhcNMTYwNjIyMDAwMDAwWhcNMzYwNjIyMDAw
+MDAwWjBHMQswCQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZp
+Y2VzIExMQzEUMBIGA1UEAxMLR1RTIFJvb3QgUjQwdjAQBgcqhkjOPQIBBgUrgQQA
+IgNiAATzdHOnaItgrkO4NcWBMHtLSZ37wWHO5t5GvWvVYRg1rkDdc/eJkTBa6zzu
+hXyiQHY7qca4R9gq55KRanPpsXI5nymfopjTX15YhmUPoYRlBtHci8nHc8iMai/l
+xKvRHYqjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1Ud
+DgQWBBSATNbrdP9JNqPV2Py1PsVq8JQdjDAKBggqhkjOPQQDAwNnADBkAjBqUFJ0
+CMRw3J5QdCHojXohw0+WbhXRIjVhLfoIN+4Zba3bssx9BzT1YBkstTTZbyACMANx
+sbqjYAuG7ZoIapVon+Kz4ZNkfF6Tpt95LY2F45TPI11xzPKwTdb+mciUqXWi4w==
+-----END CERTIFICATE-----

crates/x509_util/src/lib.rs

@@ -302,6 +302,17 @@ where
 
     // If we haven't yet found a path to a trusted root, check if we can find
     // one for the last cert in the chain. If we can't, fail chain validation.
+    // At this point, `path_to_root` is `Some(...)` if all of the following
+    // conditions hold:
+    //
+    //     1. `opts.stop_on_first_trusted_cert` is set to true
+    //     2. The submitted cert chain contains at least one intermediate
+    //      (otherwise we never enter the above loop).
+    //     3. We found a path to a trusted cert and broke from the loop early,
+    //      before processing the last cert in the chain.
+    //
+    // Otherwise, we still need to try to find a path to a trusted root for the
+    // last cert in the chain.
     let path_to_root = if let Some(path) = path_to_root {
         path
     } else {
@@ -417,11 +428,11 @@ fn is_link_valid(child: &Certificate, issuer: &Certificate) -> bool {
 /// # Arguments
 ///
 /// * `ca_cert` - The CA certificate to check.
-/// * `current_path_len` - The number of intermediate certificates preceding the
-///   CA certificate in the chain. Note that end-entity certs are not counted.
+/// * `num_intermediates` - The number of intermediate certs preceding the cert
+///   in the chain. This is used for checking the path length basic constraint.
 fn check_ca_basic_constraints(
     ca_cert: &Certificate,
-    current_path_len: usize,
+    num_intermediates: usize,
 ) -> Result<(), ValidationError> {
     // Check the cert's basic constraints.
     if ca_cert
@@ -436,7 +447,7 @@ fn check_ca_basic_constraints(
             // certificate is not included in this limit.
             if bc
                 .path_len_constraint
-                .is_some_and(|max| current_path_len > (max as usize))
+                .is_some_and(|max| num_intermediates > (max as usize))
             {
                 return true;
             }
@@ -454,7 +465,7 @@ macro_rules! build_chain {
         ($($root_file:expr),+) => {{
             let mut chain = Vec::new();
             $(
-                chain.append(&mut Certificate::load_pem_chain(include_bytes!($root_file)).unwrap());
+                chain.append(&mut Certificate::load_pem_chain(include_bytes!($root_file)).expect("failed to parse PEM file"));
             )*
             chain
         }}
@@ -517,7 +528,26 @@ mod tests {
             test_validate_chain!($name; "../../static_ct_api/tests/fake-ca-cert.pem", "../../static_ct_api/tests/fake-root-ca-cert.pem", "../../static_ct_api/tests/ca-cert.pem", "../../static_ct_api/tests/real-precert-intermediate.pem"; $($chain_file),+; None; None; true; 0; $stop_on_first_trusted_cert);
         };
     }
-
+    test_validate_chain!(
+        cloudflare_chain_with_cross_signed_gts_root_by_untrusted_globalsign_success;
+        "../../static_ct_api/tests/google-gts-root-r4.pem";
+        "../../static_ct_api/tests/cloudflare.pem";
+        None;
+        None;
+        false;
+        2;
+        true
+    );
+    test_validate_chain!(
+        cloudflare_chain_with_cross_signed_gts_root_by_untrusted_globalsign_fail;
+        "../../static_ct_api/tests/google-gts-root-r4.pem";
+        "../../static_ct_api/tests/cloudflare.pem";
+        None;
+        None;
+        true;
+        0;
+        false
+    );
     test_validate_chain_fail!(
         missing_intermediate_ca;
         "../../static_ct_api/tests/leaf-signed-by-fake-intermediate-cert.pem";